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The  Secretary  of  Energy 

Dear  Mr.  Secretary: 

This  report,  which  is  part  of  our  general  management  review,  presents  the  results  of  our  review 
of  the  Department's  information  resources  management  program.  We  reviewed  this  program 
under  our  legislative  authority  to  evaluate  federal  agencies  and  programs. 

This  report  contains  recommendations  to  you  in  chapter  6.  As  you  know,  31  U.S.C.  720  requires 
the  head  of  a  federal  agency  to  submit  a  written  statement  of  actions  taken  on  our 
recommendations  to  the  Senate  Committee  on  Governmental  Affairs  and  the  House  Committee 
on  Government  Operations  not  later  than  60  days  after  the  date  of  this  letter.  A  written 
statement  must  also  be  submitted  to  the  House  and  Senate  Committees  on  Appropriations  with 
the  agency’s  first  request  for  appropriations  made  more  than  60  days  after  the  date  of  this  letter. 
We  would  appreciate  receiving  copies  of  these  statements. 

We  are  providing  copies  of  this  report  to  interested  members  of  the  Congress,  executive  branch 
agencies,  and  the  public.  We  will  also  make  copies  available  to  others  upon  request  This  work 
was  performed  under  the  direction  of  JayEtta  Z.  Hecker,  Director,  Resources,  Community,  and 
Economic  Development  Information  Systems,  who  can  be  reached  at  (202)  512-6416.  Other 
mayor  contributors  are  listed  in  appendix  n. 


Sincerely  yours, 


Executive  Summary 


Purpose 


Background 


The  Department  of  Energy  (doe)  is  responsible  for  multiple  energy  and 
defense  missions  that  are  important  to  economic  growth,  public  health 
and  safety,  and  the  nation’s  security,  doe  also  faces  complex  challenges, 
such  as  massive  environmental  damage  and  unsafe  nuclear  weapons 
production  facilities,  and  management  problems,  such  as  weak  controls 
over  contractor  activities.  To  successfully  accomplish  doe’s  missions  and 
correct  existing  problems,  the  Secretary  and  departmental  and  contractor 
managers  need  timely,  reliable,  and  relevant  information. 

gao  examined  key  aspects  of  the  Department’s  information  resources 
man?gement  (irm)  program,  focusing  primarily  on  the  environmental 
restoration,  safety  and  health  management,  nuclear  weapons  production, 
and  security  mission  areas,  gao’s  objectives  were  to  determine  whether 
(1)  information  shortfalls  impair  managers’  ability  to  fulfill  their 
responsibilities,  (2)  doe’s  strategic  irm  planning  is  linked  to  strategic 
mission  planning,  and  (3)  management  control  over  the  acquisition  and 
operation  of  information  systems  is  adequate  to  ensure  compliance  with 
federal  and  doe  irm  policies  and  requirements. 


doe  was  established  in  1977  to  consolidate  several  agencies  that  had 
energy-  and  defense-related  missions.  Today,  doe  has  over  30  headquarters 
program  offices,  8  field  offices,  2  power  marketing  administrations,  and 
several  other  facilities  that  manage  or  support  its  various  missions,  doe’s 
fiscal  year  1991  budget  was  over  $24  billion.  About  $1.6  billion,  or  almost  7 
percent  of  the  total  budget,  was  for  the  acquisition,  operation,  and 
maintenance  of  information  resources. 

The  Department’s  operations  are  spread  across  the  country  and  are  largely 
performed  by  contractors  who  operate  government-owned  research 
laboratories  and  manufacturing  plants.  Until  recently,  doe  exercised  only 
limited  control  over  day-to-day  contractor  activities.  However,  in  response 
to  criticism  that  this  approach  created  a  high  risk  of  fraud,  waste,  or 
abuse,  the  Secretary  has  taken  action  to  strengthen  contractor 
accountability  and  improve  contract  management  and  oversight  practices. 
As  a  result,  doe  has  undergone  significant  organizational  and  cultural 
changes  in  recent  years. 

The  Director,  Office  of  Administration  and  Human  Resources,  serves  as 
the  designated  senior  official  (dso)  for  irm.  The  Director,  Office  of 
Information  Resources  Management  (oirm),  is  the  senior  full-time  irm 
manager.  In  addition,  most  headquarters  program  offices,  field  offices,  and 


Page  2 


GAO/IMTEC-92-B3  Energy  Needs  Better  IRM 


Executive  Summery 


contractors  employ  irm  support  staff  to  plan  and  control  their  respective 
information  resources  within  a  policy  framework  established  by  oirm. 

gao  reports  dating  back  to  1978  have  identified  information  problems  and 
a  lack  of  effective  processes  to  plan  and  control  the  Department’s 
information  resources.  Although  doe  has  recognized  that  opportunities 
exist  to  improve  how  it  manages  information,  it  has  not  identified  the 
specific  changes  required. 


Results  in  Brief 


Although  doe  relies  heavily  on  information  to  accomplish  its  missions, 
managers  and  staff  throughout  doe  are  not  always  receiving  the 
information  they  need.  As  a  result,  they  are  hindered  in  accomplishing 
their  missions,  which  may  in  turn  increase  the  risks  that  the  public  will  be 
unnecessarily  exposed  to  dangerous  contaminants;  the  safety  and  health 
of  workers  will  not  be  adequately  protected;  outdated  weapons 
components  will  continue  to  be  produced  and  discarded;  and  facilities, 
secrets,  and  employees  will  not  be  properly  protected  from  threats.  In 
addition,  DOE  is  wasting  resources  developing  and  operating  information 
systems  that  overlap  or  duplicate  existing  systems. 

These  problems  exist  because  doe  has  not  (1)  implemented  a  strategic  irm 
planning  process  that  focuses  information  resource  investments  on 
achieving  strategic  mission  objectives,  and  (2)  exercised  adequate 
management  control  to  ensure  that  irm  activities  are  conducted  in 
accordance  with  laws  and  policies.  Without  a  strategic  irm  plan,  doe  has 
difficulty  identifying  the  information  needed  to  meet  mission  needs 
departmentwide.  Without  effective  control,  doe  has  difficulty  preventing 
overlapping  and  duplicate  information  systems  and  ensuring  that  new  and 
existing  information  systems  meet  mission  needs,  doe’s  ability  to  improve 
irm  planning  and  strengthen  controls  is  limited,  however,  because  program 
managers  and  irm  oversight  staff  have  not  been  assigned  clear 
responsibility  or  sufficient  authority  to  do  so.  Senior  oirm  and  mission 
planning  officials  note  that  efforts  to  improve  irm  activities  are  also 
hindered  because  of  the  limited  numbers  of  staff  with  the  required  skills. 

Underlying  doe’s  ineffective  irm  planning  and  management  control  is  a 
lack  of  top  management  attention  to  the  importance  of  managing 
information.  The  Department’s  past  emphasis  on  a  “least  interference” 
approach  to  managing  Department  activities  has  led  to  a  lack  of  emphasis 
on  information  needs.  The  Secretary  has  generally  strengthened 
management  control  and  accountability  for  accomplishing  Department 
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missions  by  assigning  headquarters  program  managers  the  responsibility 
and  authority  to  plan  and  control  field  office  and  contractor  resources. 
However,  inadequate  top  management  attention  to  the  importance  of 
information  continues  because  the  Secretary’s  reforms  have  not  focused 
on  the  need  for  better  irm  to  support  doe’s  missions.  As  a  result,  program 
managers  have  not  assumed  responsibility  for  or  improved  their  control 
over  information  resources. 


Principal  Findings 


Lack  of  Information  DOE  spent  about  $1  billion  in  1991  on  environmental  activities;  however, 

Impairs  Missions  and  program  office,  field  office,  and  contractor  managers  do  not  always  have 

Wastes  Resources  the  information  they  need  to  determine  the  nature  and  extent  of 

environmental  contamination  or  to  set  priorities  and  monitor  the  progress 
of  clean-up  efforts.  Similarly,  doe  managers  struggle  to  provide  a  safe  and 
healthful  work  environment  in  part  because  they  do  not  always  have 
reliable  information  with  which  to  identify  and  track  workplace  safety  and 
health  violations,  set  priorities,  and  assess  the  effectiveness  of  corrective 
actions.  The  inability  to  communicate  information  in  a  timely  and  reliable 
manner  among  facilities  that  design  and  produce  nuclear  weapons 
contributes  to  inefficiency  and  waste  in  accomplishing  the  Department’s 
defense  mission.  Finally,  although  security  is  an  essential 
function — costing  nearly  $1  billion  a  year — information  deficiencies 
reduce  doe’s  ability  to  ensure  the  effectiveness  of  its  security  program. 
These  information  deficiencies  include  limited  capabilities  to  analyze 
security  weaknesses  and  incidents,  as  well  as  problems  keeping  an 
accurate  list  of  active  security  clearances  and  tracking  foreign  visitors  to 
sensitive  facilities. 

doe  is  also  wasting  money  developing  and  operating  systems  that  perform 
similar  functions.  Instances  of  overlapping  or  duplicate  systems1  have  been 
documented  in  all  four  mission  areas  included  in  this  evaluation.  Although 
information  was  not  readily  available  to  quantify  the  waste  associated  with 
overlap  and  duplication,  the  amount  is  significant.  For  instance,  the  doe 
Inspector  General  found  that  the  Department  spent  over  $8  million  at 
three  sites  developing  and  operating  overlapping  environmental 
compliance  systems,  oirm  officials  agreed  that  a  significant  amount  of 


'An  overlapping  system  Is  described  as  one  that  performs  some,  but  not  all,  functions  of  an  existing 
system.  A  duplicate  system  is  one  that  performs  essentially  the  same  (Unctions  as  an  existing  system. 
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resources  is  spent  on  the  development  and  operation  of  overlapping  and 
duplicate  systems. 


Strategic  IRM  Planning  One  reason  why  managers  do  not  receive  the  information  they  need  and 

Process  Is  Needed  resources  are  wasted  is  that  doe’s  irm  plans  are  not  focused  on  achieving 

the  Department's  missions.  For  instance,  doe’s  long-range  information 
technology  plan  is  a  compilation  of  acquisition  projects  that  were 
independently  planned  by  over  50  organizational  elements  to  satisfy  their 
individual  information  needs.  As  a  result,  doe  has  not  analyzed 
departmentwide  information  needs  or  developed  information  system 
architectures  that  describe  what  information  systems  are  needed  and  how 
they  should  fit  together  to  achieve  mission  objectives.  Although  doe  policy 
requires  program  managers  to  develop  strategic  mission  plans  that 
consider  financial  and  human  resource  needs,  the  policy  does  not  require 
managers  to  assess  their  information  and  technology  needs.  Program 
managers’  and  irm  oversight  staffs’  ability  to  prepare  strategic  irm  plans  is 
also  hindered  by  unclear  responsibility  and  limited  authority. 


Management  Control  Over 
Information  Resources  Is 
Needed 


doe  also  does  not  exercise  sufficient  management  control  to  ensure  that 
information  resources  are  managed  effectively.  Management  control  over 
the  acquisition  and  use  of  information  resources  is  essential  to  (1)  ensure 
that  information  systems  meet  mission  needs  and  (2)  prevent  waste. 
Inadequate  management  control  contributes  to  waste  associated  with 
developing  and  operating  overlapping  and  duplicate  information  systems. 
doe  has  also  wasted  money  developing  systems  that  did  not  meet  users’ 
needs  because  developers  were  not  required  to  follow  doe’s  policy 
requiring  the  use  of  life-cycle  system  development  methodologies. 
Similarly,  many  existing  information  systems  do  not  meet  users’ 
information  needs  because  doe  does  not  have  an  effective  process  for 
evaluating  operational  systems.  Unclear  responsibility  and  limited 
authority  hinder  program  managers’  and  irm  oversight  staffs’  ability  to 
exercise  management  control.  Although  the  Secretary  issued  a  directive  to 
strengthen  headquarters  managers’  control  over  field  office  and  contractor 
activities — including  their  use  of  financial  and  human  resources — the 
directive  did  not  mention  information  resources.  As  a  result,  although 
program  managers  have  centralized  their  control  over  doe’s  programs, 
they  have  not  strengthened  their  control  over  irm  resources  to  improve  irm 
support  to  their  missions  and  reduce  waste. 
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Leadership  Is  Essential  for  An  effective  IRM  program  requires  commitment  of  the  agency’s  leadership, 
Effective  IRM  a  clearly  articulated  vision  of  how  information  can  contribute  to 

accomplishing  mission  objectives,  and  a  concrete  plan  for  implementing 
this  vision.  Until  the  Secretary  and  senior  managers  identify  irm 
deficiencies  as  a  departmentwide  problem,  articulate  a  clear  vision  of  how 
information  can  help  accomplish  agency  missions,  and  ensure  that  the 
vision  is  implemented,  irm  improvement  efforts  are  unlikely  to  succeed. 
Implementing  such  a  vision  will  require  the  Secretary  to  ensure  that 
program  managers  and  irm  oversight  staff  have  clearly  defined 
responsibilities,  sufficient  authority,  and  adequately  trained  staff  to  plan 
and  control  information  resource  activities. 


Recommendations 


Although  the  Department  is  taking  steps  to  improve  the  management  of 
information  resources,  gao  believes  that  doe  can  further  strengthen  its 
management  of  these  resources.  Specifically,  the  Secretary  of  Energy 
should  take  the  following  steps: 

Work  with  senior  program  managers  and  the  designated  senior  official  to 
develop  a  clear  vision  of  how  information  and  information  resources  can 
contribute  to  accomplishing  critical  missions  and  commit  the  Department 
to  making  the  vision  a  reality. 

Clarify  program  managers’  and  the  designated  senior  official’s 
responsibilities  and  give  them  sufficient  authority  to  plan  and  control 
information  resources  departmentwide,  ensure  that  they  understand  their 
roles  and  responsibilities,  and  ensure  that  adequate  staff  with  appropriate 
skills  are  made  available. 

Hold  these  managers  accountable  for  (1)  linking  irm  planning  with  doe’s 
strategic  mission  planning  process,  (2)  preparing  strategic  and  tactical 
plans  and  information  architectures,  and  (3)  strengthening  controls  over 
irm  activities. 

Report  irm  deficiencies  as  a  material  internal  control  weakness  under  the 
Federal  Managers’  Financial  Integrity  Act  until  the  Secretary  has 
reasonable  assurance  that  information  resources  are  being  applied 
efficiently  and  in  accordance  with  laws,  regulations,  and  policies. 

Chapter  6  provides  additional  detail  on  these  recommendations. 


Agency  Comments 


In  commenting  on  a  draft  of  this  report,  doe  stated  that  it  agreed  with 
Gao’s  recommendations  and  identified  a  number  of  specific  actions  it  will 
take  to  implement  them.  Although  these  actions  appear  to  be  generally 
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responsive  to  the  recommendations,  they  do  not  fully  address  them.  In 
particular,  doe  still  needs  to  clarify  what  it  will  do  to  ensure  that 
(1)  sufficient  staff  with  appropriate  technical  and  management  skills  are 
available  to  strengthen  the  irm  program  and  (2)  information  system 
architectures  are  used  to  identify  information  needs  and  determine  the 
best  alternative  to  providing  the  information. 

Although  doe  agreed  with  the  recommendations,  it  disagreed  with  much  of 
chapter  2,  which  describes  how  irm  deficiencies  both  impair  managers’ 
efforts  to  accomplish  their  missions  and  waste  resources.  After  reviewing 
doe’s  comments  and  the  evidence  cited  in  chapter  2,  Gao  continues  to 
believe  that  this  report  fairly  and  accurately  describes  the  Department’s 
information  deficiencies  and  their  effects. 

Chapter  7  provides  additional  details  on  doe’s  comments  and  gao’s 
evaluation  of  the  comments.  In  addition,  doe’s  written  comments  are 
provided  in  appendix  1. 
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Chapter  1 _ 

Introduction 


The  Department  of  Energy  was  established  in  1977  to  consolidate  several 
agencies  that  had  energy-  and  defense-related  responsibilities,  doe’s 
multiple  energy  and  defense  missions  are  important  to  economic  growth, 
public  health  and  safety,  and  the  security  of  the  nation.  Primary  doe 
missions  include  (1)  securing  future  energy  supplies,  (2)  increasing  energy 
efficiency,  (3)  enhancing  environmental  quality,  (4)  conducting 
fundamental  scientific  i  ‘search,  and  (5)  meeting  national  defense  needs. 

doe’s  fiscal  year  1991  budget  was  over  $24  billion.  About  $15.6  billion,  or 
65  percent,  was  obligated  for  contracts  to  manage  and  operate 
government-owned  facilities.  About  $1.6  billion,  or  almost  7  percent,  was 
used  for  the  acquisition,  operation,  and  maintenance  of  information 
resources.  Mo-'t  of  the  information  resources  budget  was  used  by  doe’s 
contractors. 

Today,  doe  has  over  30  headquarters  offices  that  either  manage  or  support 
its  missions.  The  Department  also  has  eight  field  offices,  each  of  which 
reports  to  one  of  four  headquarters  program  offices — Defense  Programs, 
Environmental  Restoration  and  Waste  Management,  Nuclear  Energy,  or 
Energy  Research.  The  field  offices  oversee  the  numerous 
contractor-operated  research  laboratories  and  manufacturing  plants  that 
perform  most  of  doe’s  work,  doe  also  has  power  marketing 
administrations  that  generate  and  distribute  electricity  to  large  sections  of 
the  country.  Figure  1.1  shows  doe’s  organizational  structure. 
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Figure  1.1:  The  Department  of  Energy 
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J  I  Indicates  organizational  placement  of  OIRM,  which  reports  to  the  Director  of  the  Office  of 
L"-  '  Administration  and  Human  Resource  Management 

*  Direct  access  to  the  Secretary  on  matters  of  independent  oversight 
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DOE  Relies  Heavily 
on  Contractors 


Since  the  Manhattan  Project  in  the  1940s,  doe  and  predecessor  agencies, 
the  Atomic  Energy  Commission  and  the  Energy  Research  and 
Development  Administration,  have  relied  on  long-term  contracts  with 
management  and  operating  (mao)  contractors  to  perform  most  doe 
activities.  Generally,  profit-making  industrial  corporations  operate 
production  facilities  while  academic  and  other  not-for-profit  institutions 
operate  research  facilities.  This  heavy  reliance  on  mao  contractors  to 
operate  government-owned  facilities  makes  doe  unique  among  federal 
agencies. 

Until  recently,  doe’s  operating  philosophy  was  to  give  mao  contractors 
wide  latitude  to  fulfill  their  responsibilities.  Under  this  “least  interference" 
approach,  doe  established  partnerships  with  its  contractors  and 
indemnified  them  against  most  losses.  This  approach  focused  on 
production  values  rather  than  oversight  and  control.  As  a  result,  doe’s 
culture  did  not  emphasize  the  development  of  information  or  information 
systems  to  monitor  contractor  activities.  Responding  to  criticisms  by  the 
Office  of  Management  and  Budget  (omb)  and  others  that  lax  contractor 
oversight  practices  create  a  high  risk  of  fraud,  waste,  or  abuse,  the 
Secretary  has  taken  action  to  strengthen  contractor  accountability  and 
improve  doe’s  contract  management  and  oversight  practices.  These 
actions  include  modifying  contracting  practices  and  strengthening  doe 
reviews  of  mao  contractor  performance. 


IRM  Responsibilities 
and  Organization 


The  Paperwork  Reduction  Act  of  1980  as  amended  (44  U.S.C.  chap.  35) 
was  enacted  to  improve  the  effectiveness  of  government  activities  through 
better  management  of  information.  Among  the  act’s  requirements  are  for 
agencies  to  periodically  review  their  processes  to  plan  and  control 
information  resources,  and  ensure  that  their  information  systems  do  not 
overlap  or  duplicate  existing  systems.  The  act  also  directs  each  agency  to 
appoint  a  designated  senior  official  (dso)  to  manage  agencywide 
information  activities. 


The  Director,  Office  of  Administration  and  Human  Resource  Management, 
was  appointed  by  the  Secretary  to  serve  as  the  dso.  The  Director,  Office  of 
Information  Resources  Management  (oirm),  who  reports  to  the  dso,  is  the 
full-time  senior  manager  for  doe’s  information  activities.  Within  oirm,  the 
Office  of  irm  Policy,  Plans,  and  Oversight  develops  departmental  irm 
policies  and  procedures,  compiles  the  long-range  information  technology 
plan,  oversees  the  acquisition  of  information  technology,  and  evaluates 
how  well  field  offices  and  contractors  are  implementing  doe’s  irm  policies 
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and  procedures,  oirm’s  Office  of  Information  Technology  Services  and 
Operations  acquires  and  operates  departmentwide  and  headquarters 
information  systems,  and  the  Office  of  Scientific  and  Technical 
Information  catalogs  and  disseminates  scientific  and  technical  information 
from  DOE  activities,  doe’s  headquarters  program  offices,  field  offices,  and 
most  M&o  contractors  also  have  irm  support  staff  to  manage  their 
respective  irm  activities.  Because  these  staff  report  directly  to  their 
individual  units  rather  than  to  oirm,  we  describe  them  as  irm  support  staff. 


Information 
Deficiencies  Have 
Existed  for  Years 


As  far  back  as  1978,  we  have  reported  on  information  problems  and  the 
lack  of  effective  management  processes  to  plan  and  control  the 
Department’s  information  resources.1  In  1981  we  reported  that  doe  had 
wasted  millions  of  dollars  on  a  computer  system  to  regulate  the  energy 
industry.2  In  1982  and  1986  we  reported  that  the  system  used  to  track 
nuclear  materials  needed  to  be  modernized  because  its  data  were  not 
adequate  to  meet  users’  needs.3  More  recently,  we  have  identified 
information  deficiencies  that  hinder  doe’s  ability  to  recover  oil 
overcharges;  monitor  requests  for  sensitive  information  from  foreign 
countries;  control  uranium  reprocessing  information;  account  for 
government  property;  track  nuclear  health,  safety,  and  environmental 
restoration  activities;  and  protect  doe  employees  and  facilities  from 
security  threats.4 


Efforts  to  Improve 
IRM 


Recognizing  opportunities  to  improve  how  doe  manages  information,  the 
dso  developed  and  the  Under  Secretary  signed  a  document  in  April  1991 


'Department  of  Energy's  Consolidation  of  Information  Processing  Activities  Needs  More  Attention 

(GaO/EMD-T^TWI^  1578): -  -  - 

^lljons  Wasted  Trying  to  Develop  Major  Energy  Information  System  (GACVAFMD  81-40,  May  16, 

3Obstaclea  to  U.S.  Ability  to  Control  and  Track  Weapona-Grade  Uranium  Supplied  Abroad 
(GAO/ID-82-21,  Aug.  2, 1982),  and  The  U.S.  Nuclear  Materials  Information  System  Can  Improve 
Services  to  Its  User  Agencies  (GAQ/NSlAD-86~Sl,  lan.  14,  lMiVj 

*Energv  Regulation:  The  Quality  of  DOE's  Oil  Overcharge  Information  (GACVRCED-89-104,  Mar.  16, 
1886);  Nuclear  Nonproliferation:  Department  of  Energy  Needs  Tighter  Controls  Over  Reprocessing 
Information  (GAQ/RCED-87-150,  Aug.  17, 1087);  Nuclear  Nonproliferation:  Better  Controls  Needed 
Over  Weapons- Related  Information  and  Technology  (GaO/RcEC)-88-I  i6,  June  16, 1968);  Nuclear 
Security:  DOE's  Oversight  of  Livermore's  PropertyM  anagement  System  Is  Inadequate 
(GAO/kCED-96-122,  April  18,  I960);  Nuclear  Health  and  Safety:  Need  for  Improved  Hesponsiveness  to 
Problems  at  DOE  Sites  (GAO/RCED-00-101,  Mar.  28, 1000);  and  Energy  Information:  DOE  Security 
Program  Needs  Effective  Information  Systems  (GAO/I MTEC- 92-10,  Oct  22,  1661). 
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calling  for  changes  to  doe’s  irm  program.6  The  document  identifies 
objectives  that,  if  achieved,  will  improve  how  doe  manages  information 
resources.  The  overall  objectives  cited  in  this  document  were  to 
(1)  increase  managers’  awareness  that  effective  irm  can  help  them 
accomplish  doe’s  missions,  (2)  improve  the  ability  of  irm  professionals  to 
satisfy  managers’  information  needs,  (3)  shift  doe’s  emphasis  from 
managing  information  technology  to  managing  information,  and  (4) 
provide  state-of-the-art  information  technology  to  meet  doe’s  demanding 
information  requirements,  oirm  officials  estimated  that  detailed  plans  will 
be  issued  in  late  1992. 


Objectives,  Scope, 
and  Methodology 


As  part  of  our  ongoing  general  management  review  of  doe,  we  examined 
key  aspects  of  the  Department’s  irm  program.  Our  objectives  were  to 
determine  whether  (1)  information  shortfalls  impair  doe  managers’  ability 
to  make  informed  decisions  and  fulfill  their  responsibilities,  (2)  doe’s  irm 
planning  is  closely  linked  with  its  strategic  mission  planning  and  provides 
a  strategic  focus  on  its  critical  mission  objectives,  and  (3)  doe’s 
management  control  over  systems  acquisition  and  operation  prevents 
overlap  and  duplication  and  is  sufficient  to  ensure  compliance  with  federal 
and  doe  policies  and  requirements.  Our  work  was  focused  primarily  on 
four  critical  doe  mission  areas — environmental  restoration,  safety  and 
health  management,  nuclear  weapons  production,  and  security. 

To  determine  whether  information  shortfalls  impair  managers’  ability  to 
make  informed  decisions  and  fulfill  their  responsibilities,  we  interviewed 
headquarters  and  field  office  program  managers  and  contractor  officials  to 
ascertain  their  views  on  (1)  the  adequacy  of  the  information  they  receive, 
(2)  the  extent  to  which  automated  information  system  capabilities  help 
them  meet  mission  objectives,  and  (3)  the  strengths  and  weaknesses  of 
doe’s  irm  program  and  the  need  for  improvements.  In  addition,  we 
reviewed  doe  reports  and  documents,  related  gao  reports,  and  other 
external  reports  addressing  information  shortfalls  in  these  mission  areas. 

To  determine  whether  doe’s  irm  planning  is  closely  linked  with  its  strategic 
mission  planning,  we  reviewed  federal  laws  and  regulations  as  well  as  doe 
policies  and  guidance  on  irm  planning.  We  interviewed  oirm  planning 
officials  and  both  headquarters  and  field  office  irm  and  program  officials 
to  ascertain  how  the  irm  planning  process  operates  and  their  involvement 
and  responsibilities  in  the  process.  We  also  reviewed  doe  Five-Year 


‘Vision  21:  Information  Resources  Management  Into  The  21st  Century,  A  Strategic  Planning  Program, 

DOE  OIRM,  April  ifiOl. - -  -  - — 
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Information  Technology  Resources  Long-Range  Plans,  irm  plans  for  seven 
doe  organizations,  and  the  strategic  plans  for  the  four  mission  areas  cited 
above,  to  determine  whether  irm  planning  is  focused  on  meeting  doe 
mission  objectives  and  satisfying  managers'  key  information  needs.  In 
addition,  we  reviewed  the  Department’s  plan  for  improving  irm,  and 
discussed  the  plan  and  its  implementation  status  with  oirm  officials. 

To  determine  the  adequacy  of  doe’s  management  control  over  the 
acquisition  and  operation  of  information  systems,  we  reviewed  federal 
laws  and  regulations  as  well  as  doe  policies  and  procedures  for 
(1)  preventing  overlap  and  duplication,  (2)  using  life-cycle  system 
development  methodologies,  and  (3)  evaluating  the  effectiveness  of 
existing  systems.  We  interviewed  oirm  officials  to  ascertain  the  processes 
and  controls  doe  uses  to  accomplish  each  objective.  We  also  reviewed 
oirm  reports  on  its  assessments  of  irm  management  practices  in 
headquarters,  field  offices,  and  mao  contractor  locations  to  determine 
whether  control  weaknesses  were  identified.  We  also  discussed  control 
weaknesses  with  IRM  officials  at  the  three  field  offices  we  visited. 

In  addition,  to  determine  whether  doe’s  management  control  over  system 
acquisitions  Is  sufficient  to  ensure  that  life-cycle  methodologies  are  used, 
we  reviewed  doe’s  system  development  documentation  for  three 
departmentwide  systems  that  doe  identified  as  being  mission-critical.  The 
purpose  of  these  reviews  was  to  ascertain  the  methodologies  that  were 
used  to  develop  the  systems  and  compare  the  methodologies  with  federal 
requirements,  doe  policy,  and  accepted  systems  development 
methodologies.  We  discussed  the  systems  development  practices  with  the 
program  managers  responsible  for  developing  the  three  systems.  We  also 
reviewed  reports  on  oirm  assessments  of  the  effectiveness  of  two  of  the 
three  systems. 

We  did  not  evaluate  financial  or  accounting  information  systems  because 
our  Accounting  and  Financial  Management  Division  is  covering  these 
systems  in  a  separate  review.  In  addition,  we  did  not  evaluate  doe’s 
management  of  information  resources  devoted  to  scientific  computing. 
These  resources  include  supercomputers  and  software  models  used  for 
research  purposes. 

We  performed  o»ir  work  between  April  1991  and  June  1992,  in  accordance 
with  generally  accepted  government  auditing  standards.  Our  work  was 
done  primarily  at  doe  headquarters  in  Washington,  D.C.,  and  Germantown, 
Maryland.  We  also  performed  work  at  the  doe  field  offices  and  contractor 


Page  IB 


GA0/DMTEC-M-5S  Energy  Nee*  Better  IRM 


Chapter  1 
Iatrodvctioa 


facilities  in  Albuquerque,  New  Mexico;  Idaho  Falls,  Idaho;  and  Oak  Ridge, 
Tennessee.  We  obtained  doe  comments  on  a  draft  of  this  report  and  have 
incorporated  them  as  appropriate. 
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doe  spends  billions  of  dollars  annually  to  administer  critical  energy  and 
national  defense  programs.  The  Department  also  spends  about  $1.6  billion 
annually  to  provide  its  executives,  managers,  and  staff  with  information  to 
help  them  accomplish  these  missions/  However,  despite  the  existence  of 
many  manual  and  automated  information  systems,  managers’  efforts  to 
accomplish  their  missions  and  manage  Department  activities  are  still 
hindered  because  they  do  not  have  access  to  essential  information.  This 
lack  of  information  contributes  to  environmental  restoration  managers’ 
not  being  able  to  fully  define  the  nature  and  extent  of  environmental 
contamination,  safety  and  health  managers’  not  being  able  to  accurately 
track  and  report  the  status  of  safety  and  health  violations,  nuclear 
weapons  production  managers’  scrapping  millions  of  dollars  of  parts,  and 
security  managers’  not  being  able  to  fully  analyze  security  weaknesses. 
doe  has  also  wasted  resources  developing  and  operating  multiple  systems 
to  perform  the  same  or  similar  functions.  Although  the  Secretary  and 
senior  managers  have  cited  the  need  for  better  information,  doe  actions  to 
obtain  better  information  have  not  always  been  effective. 


Environmental 
Restoration  Mission 
Impaired 


One  of  the  Secretary’s  highest  priorities  is  to  correct  the  environmental 
damage  caused  by  decades  of  inadequate  disposal  of  radioactive  and 
hazardous  waste  (see  fig.  2.1). 


'This  amount  reflects  all  funds  used  to  acquire  and  maintain  information  resources,  including 
management  and  financial  systems,  telecommunications,  personal  computers,  and  supercomputers. 
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Source:  Department  of  Energy 
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doe  spent  over  $1  billion  on  environmental  restoration  activities  in  fiscal 
year  1991,  primarily  to  identify  and  characterize  the  nature  and  extent  of 
contamination.  Although  doe  plans  to  spend  billions  more  over  the  next  5 
years,  it  has  not  effectively  managed  the  information  it  collects.  As  a 
result,  doe  managers  often  do  not  have  the  information  they  need  to 
determine  the  nature  and  extent  of  environmental  contamination,  set 
priorities  for  clean-up  efforts,  and  monitor  progress. 

According  to  an  April  1990  doe  Inspector  General  report,2  the  local  systems 
that  doe  uses  to  track  and  report  compliance  with  state  and  federal 
environmental  laws  were  developed  over  the  years  by  various  offices  and 
contractors.  The  report  noted  that  many  of  these  environmental 
compliance  systems  did  not  meet  the  Department’s  needs  for  tracking  and 
reporting  compliance  and  that  doe  could  not  readily  determine  how  many 
actual  and  potential  violations  of  environmental  laws  existed  throughout 
the  Department  or  the  status  of  corrective  actions. 

The  Associate  Director  for  Environmental  Restoration  and  other 
headquarters  program  managers  confirmed  that  they  do  not  always 
receive  timely  and  reliable  information  to  effectively  carry  out  the 
program.  For  example,  a  branch  manager  told  us  that  the  lack  of  an 
effective  information  system  contributes  to  delays  in  securing  or  restoring 
some  sites.  He  explained  that  because  doe  does  not  have  a  system  that 
tracks  the  status  of  hazardous  or  contaminated  sites,  reports  from  field 
offices  sometimes  “fall  between  the  cracks.”  In  one  case,  a  report 
identifying  the  need  to  secure  a  hazardous  site  was  forgotten  in  a  desk 
drawer  at  a  field  office  for  almost  a  year,  thereby  delaying  headquarters’ 
awareness  of  the  danger  and  allowing  the  site,  which  is  located  on  public 
lands,  to  remain  open  to  the  public.  According  to  field  office 
environmental  restoration  officials,  it  is  not  unusual  for  reports  to  be 
misplaced,  thus  temporarily  losing  track  of  hazardous  sites.  They  also 
believe  that  an  effective  information  system  would  preclude  this  problem 
because  information  about  the  site  could  be  entered  into  a  computer 
system  and  then  tracked  from  the  time  the  M&o  contractor  first  identified 
the  hazard. 

Other  studies,  performed  both  by  doe  and  outside  sources,  have  revealed 
other  information  problems  that  adversely  affect  the  accomplishment  of 


Management  Information  Systems  for  Environmental  Compliance  Activities  (DOE/1G-0284, 
Apr.  23,  I960). 
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the  environmental  restoration  mission.3  For  example,  doe  studies  show 
that  field  office  managers  and  contractors  cannot  accurately  define  the 
type  and  extent  of  contamination  at  particular  sites  because  data  collected 
to  assess  the  scope  of  contamination  are  inaccurate,  inconsistent,  or 
inaccessible.  According  to  these  studies,  data  management  problems  have 
affected  the  quality  of  decisions.  The  studies  also  point  out  that  when 
technical  assessment  data  are  not  usable,  managers  compensate  by 
gathering  more  samples,  which  in  turn  increases  costs — and  sometimes 
the  hazard  itself.  For  example,  if  new  wells  must  be  drilled  to  gather  more 
sample  data,  doe  may  actually  increase  the  hazard  by  creating  new 
pathways  in  which  the  contaminants  can  spread. 

doe  has  been  working  since  1984  to  develop  and  implement  a 
departmentwide  system  to  support  environmental  restoration 
decision-making.  However,  after  8  years  and  about  $24  million,  the  system 
is  not  yet  complete  and  none  of  the  seven  program  managers  we 
interviewed  said  they  use  the  system  as  a  decision-support  tool.  The 
Associate  Director  for  Environmental  Restoration  confirmed  that  the 
system  does  not  provide  the  information  he  and  his  staff  need  to  make 
environmental  assessment  and  restoration  decisions.  At  the  conclusion  of 
our  review,  the  doe  manager  responsible  for  the  system  told  us  that  his 
office  was  considering  canceling  the  system  and  starting  again. 


Safety  and  Health 
Management  Mission 
Impaired 


Many  doe  facilities  are  among  the  most  potentially  hazardous  industrial 
operations  in  the  country  (see  fig.  2.2).  Literally  thousands  of  safety  and 
health  incidents  are  reported  at  these  facilities  each  year.  Safety  and 
health  violations  range  from  improperly  lined  trash  cans  for  contaminated 
waste  to  not  having  working  air  monitoring  systems  with  which  to  detect 
radioactive  leaks.  Accordingly,  the  Secretary  made  this  mission  a  high 
priority  for  managers  throughout  the  Department,  and  in  fiscal  year  1992 
planned  to  spend  $155  million  to  identify  and  correct  safety  and  health 
conditions  that  could  adversely  affect  doe  employees,  the  public,  and  the 
environment.  Despite  this  increased  attention,  doe  managers  struggle  to 
achieve  their  safety  and  health  mission  in  part  because  they  do  not  always 
have  access  to  reliable  information. 


^Complex  Clean-up:  The  Environmental  Legacy  of  Nuclear  Weapons  Production,  Office  of  Technology 
Assessment  (Of  A-0-485,  February  1991);  Management  Information  Systems  for  Environmental 
Compliance  Activities  (DOFyiG-0284,  Apr.  23, 1900);  Development  of  Consolidated  Environmental 
Data  Base  (DOE,  Feb.  6, 1990);  Prototype  Electronic  Reporting  System  (ll.S.  Environmental  Protection 
Agency  Region  IV  and  the  Agency  for  Toxic  Substances  and  Disease  Registry  [undated]). 
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Source:  Department  of  Energy 


A  senior  safety  and  health  official  told  us— and  studies  by  safety  and 
health  assessment  teams  confirmed — that  many  of  doe’s  offices  and  sites 
do  not  have  information  systems  that  are  capable  of 
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(1)  compiling  and  updating  safety  and  health  regulations  and  guidance,  (2) 
tracking  violations  from  identification  to  abatement,  and  (3)  tracking 
deficiencies  that  allow  these  violations  to  occur.  A  preliminary  analysis  by 
doe  of  environmental,  safety,  and  health  assessments  at  its  sites  disclosed 
that  83  percent  of  doe’s  offices  and  sites  do  not  have  information  systems 
that  can  track  and  report  the  status  of  safety  and  health  activities  or 
needed  corrective  actions.4 

In  March  1990,  we  reported  that  doe’s  departmentwide  system  for  tracking 
safety  and  health  activities  did  not  provide  enough  detailed  information  to 
track  issues  or  support  decision-making.6  According  to  safety  and  health 
officials  at  headquarters  and  field  offices,  the  lack  of  a  useful 
departmentwide  system  continues  to  preclude  the  comprehensive 
analyses  they  need  to  manage  safety  and  health  activities  effectively.  For 
example,  the  Acting  Director  of  the  Performance  Assessment  Division  said 
he  was  unable  to  ftilly  analyze  safety  incidents  at  10  high-risk  facilities 
because  data  in  the  departmentwide  system  were  not  complete  and  lacked 
sufficient  detail. 

In  this  regard,  a  recent  DOE  evaluation  of  the  departmentwide  system 
confirmed  that  the  system  is  not  meeting  the  needs  of  doe  managers. 
Among  many  other  problems,  the  evaluation  found  that  data  are 
incomplete,  out  of  date,  or  not  in  the  proper  format  for  analysis;  user 
training  has  been  inadequate;  and  system  managers  have  neither  identified 
user  information  needs  nor  incorporated  modem  technology  into  the 
system.6  At  the  conclusion  of  our  review,  the  senior  program  management 
official  responsible  for  identifying  safety  and  health  information 
requirements  said  the  existing  departmentwide  system  is  unable  to  meet 
managers’  information  needs  and  that  his  office  plans  to  replace  the 
system. 


Nuclear  Weapons 
Production  Mission 
Impaired 


Meeting  the  nation’s  defense  needs,  which  includes  the  research, 
development,  production,  and  decommissioning  of  nuclear  weapons,  is 
doe’s  most  costly  mission — accounting  for  about  $8  billion  of  the 
Department’s  approximately  $24-billion  budget.  Nuclear  weapons  are 
designed  at  three  national  laboratories,  manufactured  at  seven  production 


‘Environmental  Restoration  and  Waste  Management  Five-Year  Plan,  Fiscal  Years  1992-1996 

(BOE/MOWP,  June  IMG). -  - - 

•GAO/RCED-90-101,  Mar.  28, 1990. 

•Safety  Performance  Measurement  System  Evaluation  Project  Briefing,  Department  of  Energy 
(September  1991).  2 
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plants,  and  tested  at  one  test  site.  The  Albuquerque  field  office  provides 
direction  to  ensure  that  nuclear  weapons  research,  development,  and 
production  activities  are  integrated.  The  facilities  are  located  throughout 
the  country  (see  fig.  2.3). 


Figure  2.3:  Locations  of  Facilities  That  Compose  DOE’»  Nuclear  Weapon*  Complex 
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As  far  back  as  1981,  doe  recognized  that  increasing  the  use  of  computer 
technology  could  significantly  improve  the  efficiency  of  its  manufacturing 
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and  business  processes,  doe  has  also  recognized  that  the  inability  to 
exchange  information  electronically  reduces  the  Department’s  ability  to 
manage  nuclear  weapons  activities  efficiently.7  Although  doe  has  not 
completed  a  detailed  analysis  of  the  potential  benefits  of  using  cor  ters 
in  the  manufacturing  process,  a  1986  report  estimated  that  fully 
automating  and  integrating  computer  technology  into  the  manufacturing 
process  could  eventually  save  doe  $80  million  a  year.8 

doe  has  made  significant  strides  in  automating  its  manufacturing 
operations;  however,  it  has  had  less  success  developing  systems  that  can 
electronically  exchange  data  among  facilities,  doe  attributes  this  problem 
to  the  fact  that  each  facility  develops  its  own  information  systems  without 
any  centralized  direction.  For  example,  in  an  August  1989  memorandum, 
the  deputy  manager  of  the  Albuquerque  field  office  stated  thai  the  nuclear 
weapons  complex  needed  to  move  away  from  “inefficient, 
time-consuming,  and  difficult  to  manage  piecemeal  systems  that  are  not 
integrated.”  He  noted  that  many  of  the  systems  cannot  share  or  exchange 
data  electronically  because  they  were  developed  and  managed  by  different 
offices,  with  little  or  no  coordination.  The  deputy  manager  also  stated  that 
the  nuclear  weapons  complex  needed  integrated  information  systems  to 
improve  the  management  and  control  of  weapons  production 
requirements,  reduce  costs,  and  increase  productivity. 

A  January  1990  report  by  the  Sandia  National  Laboratory  also  concluded 
that  electronic  exchange  of  infon  nation  is  a  fundamental  requirement  for 
doe’s  weapons  complex.9  The  report  pointed  out  that  during  one  10-month 
period,  facilities  exchanged  over  300,000  development  and  production 
documents.  However,  because  the  information  systems  were  not  able  to 
exchange  data,  many  documents  had  to  be  reprinted  and  mailed  to  other 
sites.  According  to  the  report,  the  inability  to  share  information 
electronically  creates  waste  by  (1)  slowing  the  production  process, 

(2)  requiring  duplicate  entry  of  information  into  computer  systen^,  and 

(3)  increasing  the  potential  for  errors. 


7Strategic  Systems  Planning  Methodology,  Holland  Systems  Corporation  [undated];  Computer 
Integrated  Manufacturing,  Accomplishments  and  Benefits  Report,  Sandia  National  Laboratory, 
September  1986;  Interagen  :y  Information  Study  (Final  Report),  Sandia  National  Laboratory,  December 
lb38;  Computer  Integrated  Manufacturing:  Planning  and  Assessment  Study,  Sandia  National 
Laboratory,  January  1990;  Nuclear  Weapons  Complex JV> gram  Requirement  Data  Base:  Initial  Project 
Document,  Albuquerque  Operations  Office,  August  1989. 


“Computer  Integrated  Manufacturing,  Accomplishments  and  Benefits  Report,  Sandia  National 
Laboratory,  September  1986. 

“Computer  Integrated  Manufacturing:  Planning  and  Assessment  Study,  Sandia  National  Laboratory, 
January  1990. 
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A  1989  study  provides  a  more  detailed  description  of  how  doe’s  inability  to 
electronically  exchange  information  creates  inefficiency  and  waste.10  It 
cited  the  inability  to  exchange  design  information  in  a  timely  and  accurate 
way  as  one  example  of  the  problems  that  exist.  The  study  noted  that  each 
manufacturing  facility  must  go  through  a  complex  series  of  manual  inputs 
and  conversions  to  enter  design  documents  inu>  their  computers,  even 
though  the  information  is  often  received  in  electronic  form.  The  study 
noted  that  this  process  is  time-consuming  and  prone  to  errors.  Although 
the  study  did  not  quantify  the  benefits  that  could  be  achieved,  doe 
weapons  complex  quality  control  and  irm  officials  estimated  that  as  a 
result  of  these  communications  problems,  plants  have  scrapped  millions  of 
dollars  worth  of  parts.  They  explained  that  when  plants  use  outdated  or 
inaccurate  engineering  drawings,  the  weapons  components  can  be 
manufactured  to  an  incorrect  tolerance  and  may  have  to  be  reworked  or 
scrapped.  According  to  these  officials,  an  integrated  information  system 
with  electronic  interfaces  between  design  and  manufacturing  plants  could 
reduce  or  eliminate  these  losses  by  ensuring  that  current  and  accurate 
engineering  drawings  are  available  at  all  locations  in  the  nuclear  weapons 
complex. 

doe  has  made  some  progress  developing  computer  systems  that  can 
exchange  data.  For  example,  weapons  components  now  have 
computer-readable  codes  that  allow  each  part  to  be  identified  and  tracked 
as  it  moves  from  plant  to  plant  or  from  department  to  department. 
However,  senior  irm  officials  from  the  Albuquerque  field  office  said  that 
efforts  to  develop  more  integrated  information  systems  have  been 
hindered  because  various  m&o  contractors  have  been  unwilling  to 
coordinate  their  information  system  developments.  During  our  review  the 
officials  agreed  to  reemphasize  the  need  to  implement  systems  that  can 
share  data. 


Security  Mission 
Impaired 


doe  spends  almost  $1  billion  annually  to  protect  against  theft,  sabotage, 
espionage,  terrorism,  and  other  risks  to  national  security  (see  fig.  2.4). 
However,  as  we  recently  reported,  this  important  mission  area  has  been 
impaired  because  the  information  systems  that  contain  data  on  security 
weaknesses  and  incidents  have  limited  analytical  capabilities  and  contain 
unreliable  information.11  As  a  result,  doe  has  difficulty  identifying  patterns 


10Nuc)ear  Weapons  Complex  Program  Requirements  Data  Base:  Initial  Project  Document,  Albuquerque 
Operations  Office,  August! 

"GAO/IMTEC-92-10,  Oct  22, 1981. 
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and  trends,  thereby  reducing  managers’  ability  to  ensure  the  effectiveness 
of  the  security  program. 


Page  26 


GAO/lMTEC-92-53  Energy  Need*  Better  IBM 


doe  has  also  wasted  resources  developing  and  operating  systems  that 
overlap  or  duplicate  existing  information  systems.  This  practice  is 
wasteful  because  the  agency  spends  funds  over  and  over  to  develop  and 
operate  systems  that  perform  the  same  or  similar  functions.  Although 
information  was  not  readily  available  to  quantify  the  extent  or  cost  of 
overlap  and  duplication,  the  following  examples  show  that  overlapping  or 
duplicate  systems  are  a  significant  problem  in  all  four  mission  areas  we 
reviewed.  At  the  conclusion  of  our  review,  the  Director,  oirm,  and  other 
senior  oirm  officials  agreed  that  the  conditions  described  below  are 
representative  of  conditions  throughout  the  Department.  The  officials  also 
agreed  that  a  significant  amount  of  resources  are  spent  on  the 
development  and  operation  of  overlapping  and  duplicate  information 
systems. 


Resources  Wasted  on 
Overlapping  or 
Duplicate  Information 
Systems 


"Nuclear  Security;  DOE  Needs  a  More  Accurate  and  Efficient  Security  Clearance  Program 
(6AO/RCEt>-88-28,  Dec.  2fi,  1987). 

"Nuclear  Nonproliferation:  Major  Weaknesses  in  Foreign  Visitor  Controls  at  Weapons  Laboratories 
(OaO/RCED-SMI, Oct  II,  1988). 
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Environmental  restoration  managers  throughout  doe  perform  similar 
functions — identifying,  assessing,  and  correcting  environmental  problems. 
However,  in  1990  the  doe  Inspector  General  concluded  that  the 
Department  spent  substantial  resources  developing  and  operating  many 
overlapping  environmental  compliance  systems.14  The  Inspector  General 
found  that  three  sites  had  over  80  environmental  compliance  systems, 
many  of  which  performed  the  same  or  similar  functions,  and  that  two  of 
these  sites  spent  nearly  $8.8  million  to  develop  and  operate  these 
overlapping  and  duplicate  systems.  In  addition,  environmental  restoration 
managers  said  that  about  $24  million  has  been  spent  to  develop  and 
operate  a  system  that  tracks  environmental  compliance  activities 
departmentwide.  Because  all  eight  doe  field  offices  and  many  contractors 
develop  and  operate  individual  systems  to  perform  similar  functions,  the 
total  amount  spent  on  overlapping  and  duplicate  systems  could  be 
significant 

Safety  and  health  managers  at  sites  around  the  country  must  track  efforts 
to  correct  compliance  findings  identified  during  safety  and  health 
evaluations.  To  track  the  status  of  compliance  findings,  each  site  needs  to 
maintain  similar  information,  including  the  type  and  severity  of  the 
finding,  planned  corrective  action,  and  the  current  status  of  corrective 
actions.  However,  according  to  a  safety  and  health  information 
requirements  document,  in  addition  to  a  departmentwide  information 
system,  at  least  two  headquarters  offices,  two  field  offices,  and  one 
contractor  have  developed  or  were  developing  systems  to  perform  the 
same  function — to  track  the  status  of  safety  and  health  problems.16  A 
September  1991  evaluation  of  the  departmentwide  system  also  found  that 
field  offices  and  contractors  were  developing  their  own  local  systems  and 
databases,  even  though  an  integrated  database  is  essential  to  utilizing 
information  effectively.16  Because  all  eight  doe  field  offices  and  many  large 
contractors  need  to  maintain  this  information,  the  total  amount  spent  on 
duplicate  systems  could  be  significant. 

Managers  responsible  for  designing  and  producing  nuclear  weapons  at 
laboratories  and  plants  across  the  country  often  perform  similar  functions 
and  need  to  exchange  information,  doe  studies  have  pointed  out,  however, 


“Management  Information  Systems  for  Environmental  Compliance  Activities  (DOE/IG-0284, 

Apr.  2$  1990). - -  - - 

“DOE’s  Management  Plan  and  Requirements  Document  for  the  Environmental  Safety  and  Health 
Information  Management  Network  (Jan.  31,  1001). 

‘^Safety  Performance  Measurement  System  Evaluation  Project  Briefing,  Department  of  Energy 
(September  1001). 
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that  because  each  laboratory  and  plant  develops  its  own  systems, 
numerous  systems  perform  the  same  functions.17  Although  the  studies  do 
not  quantify  the  benefits  derived  from  preventing  overlapping  and 
duplicate  systems  among  the  seven  plants  and  two  laboratories,  significant 
benefits  are  expected. 

Finally,  in  our  recent  report  on  information  systems  that  support  doe’s 
security  program,  we  said  that  doe  wasted  resources  acquiring  many 
tracking  systems  that  could  not  electronically  share  or  exchange  security 
data  because  of  incompatible  hardware,  software,  or  data.18  This  occurred 
because  doe  did  not  assess  its  security  information  needs  from  a 
mission-oriented,  departmentwide  perspective,  but  rather  allowed  each 
security  unit  to  plan,  develop,  and  implement  its  own  systems.  A  recent 
doe  evaluation  of  the  Integrated  Security  System,  which  was  designed  to 
provide  timely  information  about  security  clearances  throughout  the 
Department,  also  found  that  field  offices  and  contractors  continue  to 
operate — and  in  some  cases  develop — new  systems  to  provide  information 
about  security  clearances  because  they  lack  confidence  in  the 
departmentwide  system.  Although  the  report  did  not  identify  the  full 
extent  of  duplicate  clearance  systems,  doe  estimated  that  in  1  year  the 
agency  spent  nearly  $500,000  to  maintain  just  five  local  systems. 


^Strategic  Systems  Planning  Methodology,  Holland  Systems  Corporation  (undated);  Computer 
Integrated  Manufacturing,  Accomplishments  and  Benefits  Report,  Sandia  National  Laboratory, 
September  1986;  Interagency  Information  Study  (Final  Report)75andla  National  Laboratory,  December 
1988;  Computer  Integrated  Manufacturing:  Planning  and  Assessment  Study,  Sandia  National 
Laboratory,  January  1990;  Nuclear  Weapons  Complex  Program  Requirement  Data  Baae:  Initial  Project 
Document,  Albuquerque  Operations  Office,  August  1989. 


l*GAO/IMTEC-92-10,  Oct  22,  1991. 


Page  29 


GAO/TMTEC-9J-8S  Energy  Needs  Better  IBM 


Chapter  3 _ 

IRM  Planning  Is  Not  Linked  to  Strategic 
Mission  Objectives 


One  reason  why  information  shortfalls  continue  to  impair  doe  mission 
effectiveness  and  resources  are  wasted  is  that  information  resource 
investments  are  not  focused  on  meeting  strategic  mission  objectives.  This 
focus  is  not  achieved  because  the  Department’s  irm  planning  is  not  linked 
to  its  strategic  mission  planning.  Instead,  irm  planning  is  accomplished  by 
irm  staff  at  individual  offices  and  mao  contractor  facilities  who  are  intent 
on  satisfying  their  local  information  needs.  Because  of  the  fragmented 
nature  of  irm  planning,  doe  has  not  conducted  departmentwide  analyses  of 
the  information  needed  to  accomplish  its  missions  or  prepared 
information  system  architectures1  that  define  how  information  systems 
should  work  together  to  satisfy  those  needs.  Unclear  responsibilities  and 
limited  authority  over  irm  planning  activities  limit  both  the  dso’s  and 
program  managers’  ability  to  plan  information  resources. 


Federal  law  and  regulations  require  agencies  to  implement  a  strategic  irm 
planning  process  that  helps  managers  define  what  information  they  need 
to  accomplish  mission  objectives  and  helps  prevent  overlapping  and 
duplicate  information  systems.2  Strategic  planning  helps  ensure  that 
information  resources  are  focused  on  achieving  agency  missions  by 
directly  linking  the  organization’s  strategic  mission  objectives  to  the 
information  and  resources  needed  to  achieve  the  objectives.  A  strategic 
irm  plan  also  provides  the  basis  for  developing  both  information  system 
architectures  and  more  detailed  tactical  plans.  The  architectures  and 
supporting  plans  are  then  used  to  guide  and  control  investments  in 
information  technology. 

A  recently  issued  gao  staff  study  highlights  the  importance  of  strategic 
information  planning.3  The  study  points  out  that  strategic  planning  is  a 
disciplined,  systematic  approach  to  determining  the  most  effective  and 
efficient  approach  to  satisfying  organizational  information  needs. 
Preparing  open  and  flexible  information  system  architectures  is  an 
essential  part  of  this  process.  The  process  of  preparing  architectures 
provides  discipline  through  its  requirements  for  a  top-down  structured 
analysis  to  identify  information  needs  departmentwide  and  analyze 


Strategic  Planning  Is  a 
Critical  IRM  Activity 


‘An  information  system  architecture  is  a  description  of  all  functional  activities  to  be  performed  to 
achieve  a  desired  mission,  the  system  elements  needed  to  perform  the  functions,  and  the  designation 
of  performance  levels  of  those  system  elements.  An  architecture  also  includes  information  on  the 
technologies,  interfaces,  and  locations  of  functions,  and  is  considered  an  evolving  description  of  an 
approach  to  achieving  a  desired  mission. 

*The  Paperwork  Reduction  Act  and  OMB  Circular  A-130. 

’Strategic  Information  Planning:  Framework  for  Designing  and  Developing  System  Architectures 
(GAO/IMTEC-92-15I,  June  ife2). 
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technical  alternatives  to  meet  those  needs.  Overall,  a  strategic  irm  planning 
process  helps  organizations  achieve  their  missions  by  identifying  the 
information  and  technology  needed  to  meet  mission  objectives,  by  setting 
priorities,  and  by  guiding  information  technology  investments. 


In  July  1990,  the  Secretary  initiated  a  strategic  mission  planning  process  by 
directing  program  managers  to  identify  mission  objectives  and  strategies 
for  achieving  them,  doe  developed  planning  guidance  that  calls  for 
program  managers  to  assess  their  strategic  mission  objectives  and  to 
prepare  strategic  and  tactical  plans  that  integrate  headquarters,  field 
office,  and  contractor  requirements.  However,  although  information  is 
generally  recognized  as  a  resource  that  should  be  managed  just  like 
financial  and  human  resources,  the  guidance  does  not  mention  the  need  to 
assess  strategic  information  requirements  and  resources.  Consequently, 
the  strategic  and  tactical  mission  plans  from  the  four  program  offices  we 
reviewed  identified  strategic  mission  objectives  and  addressed 
departmentwide  financial  and  human  resource  needs.  However,  the  plans 
did  not  address  strategic  information  requirements  or  resources  needed  to 
accomplish  the  objectives.  Planning  officials  from  the  four  program  offices 
told  us  they  do  not  analyze  strategic  information  requirements  because  irm 
planning  is  done  under  a  separate  process. 

However,  because  doe’s  separate  irm  planning  process  does  not  integrate 
headquarters,  field  office,  and  contractor  information  requirements,  it 
does  not  closely  link  information  needs  to  mission  objectives.  Instead,  the 
process  is  driven  by  individual  offices  and  m&o  contractors,  who  are 
focused  on  trying  to  satisfy  their  own  parochial  needs  for  information 
technology.  According  to  doe  planning  documents  and  senior  oirm 
planning  officials,  irm  officials  located  at  over  50  doe  organizational 
elements — including  program  offices,  field  offices,  and  m^yor  m&o 
contractors — each  develop  their  own  long-range  information  technology 
plans.  These  individual  plans  are  then  submitted  concurrently  to  oirm  and 
headquarters  program  managers  for  comment,  oirm  officials  told  us  they 
receive  few,  if  any,  program  office  comments  on  the  plans  and  essentially 
just  compile  the  individual  plans  to  form  doe’s  Five-Year  Information 
Technology  Resources  Long-Range  Plan. 

Figure  3.1  shows  how  the  integrated  doe  mission  planning  process 
incorporates  contractor  and  field  office  requirements  into  the  program 
offices’  mission  plans.  In  contrast,  the  irm  planning  process  does  not 


IRM  Planning  Does 
Not  Focus  on  Mission 
Objectives 


Page  31 


GAO/IMTEC-92-53  Energy  Needs  Better  IRM 


Clusters 

IBM  Planning  la  Not  linked  to  Strategic 
Miaaioa  Objective# 


incorporate  field  office  and  contractor  information  requirements  into  the 
program  offices’  irm  plans. 
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We  reviewed  the  irm  plans  that  were  developed  by  seven  organizational 
elements  and  found  six  to  be  deficient  because  either  they  did  not  address 
(1)  how  the  planned  information  technology  acquisitions  or  activities 
would  contribute  to  meeting  mission  needs — a  fundamental  element  of 
strategic  irm  planning,  or  (2)  acquisition  and  development  costs  for  key 
information  systems.  We  also  reviewed  doe’s  1990  Five-Year  Information 
Technology  Resources  Long-Range  Plan  and  found  that  it  too  did  not 
clearly  link  information  technology  requirements  to  mission  objectives. 
Instead,  the  plan  focused  primarily  on  planned  technology  acquisitions  by 
individual  offices  and  key  irm  initiatives  such  as  improving  software 
management  and  meeting  future  supercomputer  needs.  Although  one 
section  discussed  how  information  technology  was  being  used  to  support 
mission  objectives,  the  section  included  only  limited  examples  of 
information  technology  acquisitions  planned  by  individual  organizational 
elements. 


Unclear  responsibility  and  limited  authority  affect  both  the  dso’s  and 
program  managers’  ability  to  improve  irm  planning.  According  to  the 
Paperwork  Reduction  Act  and  supporting  guidance  from  the  General 
Services  Administration  (gsa),  the  dso  should  be  responsible  for 
maintaining  an  effective  irm  strategic  planning  process.4  Because 
information  is  a  primary  resource  needed  to  accomplish  missions,  the  gsa 
guidance  also  calls  for  program  managers  to  be  responsible  for  planning 
activities  related  to  their  information  needs,  doe’s  irm  orders,  however,  do 
not  clearly  assign  to  the  dso  responsibility  for  preparing  a  strategic  IRM 
plan  that  links  information  planning  to  mission  planning.  Instead,  the  dso 
is  responsible  for  requesting  sites  to  submit  long-range  information 
technology  plans,  consolidating  the  plans,  and  publishing  the  consolidated 
plans  as  doe’s  Five-Year  Information  Technology  Resources  Long-Range 
Plan. 

Senior  oirm  officials  confirmed  that  doe’s  irm  orders  do  not  clearly  define 
the  dso’s  responsibility  and  authority  to  oversee  the  irm  planning  activities 
of  doe’s  offices  and  sites.  One  official  explained  that,  historically,  doe’s 
policy  allowed  field  offices  and  contractors  to  manage  their  activities  with 
minimal  interference  from  headquarters.  Another  explained  that  the  dso's 
ability  to  revise  doe’s  orders  may  be  limited  because  any  change  of 
responsibility  or  authority  must  be  coordinated  throughout  the 


*The  Senior  Federal  IRM  Manager  Major  Roles  and  Responsibilities  As  We  Move  Into  the  1990s, 
General  Services  Administration,  Information  Resource  Management  Service,  November  1987;  and  The 
IRM  Organization:  Concepts  and  Considerations  General  Services  Administration,  Federal  IRM 
Planning  Support  Center,  May  1D&1 
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Department,  and  other,  more  powerful  doe  organizations  could  be 
expected  to  object  to  changes  that  would  increase  the  dso’s  control  over 
information  resources. 

Although  doe’s  irm  orders  assign  headquarters  program  managers 
responsibility  to  review  and  approve  site  plans,  program  managers  from 
the  four  program  offices  we  reviewed  stated  that  they  have  limited 
authority  to  control  field  office  or  m&o  contractor  planning  activities,  irm 
support  staff  at  headquarters  program  offices,  field  offices,  and  contractor 
sites  we  visited  also  told  us  they  do  not  have  the  authority  to  ensure  that 
irm  planning  activities  are  coordinated  and  focused  on  meeting  mission 
needs,  even  at  their  individual  sites. 

The  Secretary  issued  a  directive  in  May  1991  that  made  headquarters 
program  managers  responsible  for  accomplishing  missions 
departmentwide,  including  the  mission  planning  activities  of  field  offices 
and  M&o  contractors.  Headquarters  program  managers  are  authorized  to 
approve  planned  field  office  and  m&o  contractor  human  resource 
budgets — subject  to  oversight  by  doe’s  Office  of  Human  Resource 
Management — and  planned  financial  budgets — subject  to  oversight  by 
doe’s  Chief  Financial  Officer.  However,  the  directive  does  not  mention 
information  resources,  leaving  unclear  program  managers’  responsibility 
and  authority  to  plan  for  information  resources. 

Although  mission  plans  based  on  the  May  1991  directive  have  not  yet  been 
completed,  program  office  planning  officials  from  the  four  mission  areas 
said  they  are  still  not  considering  strategic  information  resource  needs  in 
their  mission  planning.5  These  officials  generally  recognized  the 
importance  of  managing  irm  planning  activities  departmentwide,  but  said 
their  responsibility  and  authority  to  control  irm  planning  activities  remains 
unclear,  and  irm  planning  is  still  done  under  a  separate  process. 


“One  official,  responsible  for  preparing  strategic  plans  for  the  Office  of  Safeguards  and  Security,  noted, 
however,  that  in  February  1992,  DOE  agreed  to  develop  a  strategic  information  plan  linking  security 
information  needs  to  mission  requirements.  This  agreement  came  in  response  to  our  October  1991 
report  on  the  need  to  improve  security  information  (GAO/IMTEC-92-10).  DOE’s  response  noted  that 
OIRM  will  provide  the  leadership  to  link  security  information  planning  activities  with  the  overall 
security  mission  plan  until  the  Office  of  Safeguards  and  Security  obtains  the  authority,  funding,  and 
personnel  to  establish  an  IRM  support  section. 
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At  the  conclusion  of  our  review,  we  discussed  these  irm  planning 
deficiencies  with  senior  oirm  officials,  who  agreed  that  doe’s  irm  planning 
is  not  linked  to  strategic  mission  planning  and  that  the  irm  planning 
process  should  be  revised  to  link  mission  objectives  with  information 
resource  needs.  They  stated  that  the  irm  planning  process  was  designed 
before  the  Secretary  made  program  managers  responsible  for  controlling 
other  field  office  and  contractor  resources.  Although  they  believe  the 
Secretary’s  directive  was  intended  to  make  program  managers  responsible 
for  planning  their  information  resources,  they  agreed  the  directive  does 
not  clearly  define  program  managers’  irm  planning  responsibilities. 
Similarly,  although  they  believe  the  dso  should  be  responsible  for 
coordinating  and  overseeing  irm  planning  activities  departmentwide,  they 
agreed  that  doe’s  Orders  do  not  clearly  define  these  responsibilities  and 
authority. 

The  Director  of  Planning  and  Analysis — responsible  for  doe’s  strategic 
mission  planning  process — also  agreed  that  doe’s  irm  planning  process 
does  not  link  information  needs  to  strategic  mission  objectives  and  should 
be  revised  to  do  so.  He  stated  that  doe’s  current  irm  planning  process  does 
not  result  in  a  strategic  plan.  He  noted  that  private  industry  has  identified 
the  importance  of  strategic  information  planning  and  has  developed 
processes  to  closely  link  irm  and  mission  planning.  He  cautioned,  however, 
that  increasing  line  managers’  involvement  in  irm  planning  would  require  a 
significant  cultural  change  because  senior  program  managers  often  do  not 
recognize  the  contribution  information  can  make  or  have  been 
disappointed  with  information  system  developments  that  take  too  long, 
cost  too  much,  and  ultimately  do  not  meet  mission  needs.  He  also  pointed 
out  that  effective  irm  planning  is  a  disciplined,  technical  process  that,  to 
succeed,  would  require  staff  to  have  significantly  improved  technical  and 
management  skills. 

Finally,  the  oirm  officials  said  that  the  Department’s  April  1991  initiative  to 
strengthen  doe’s  irm  program  includes  objectives  to  strengthen  the  irm 
planning  process  and  improve  the  technical  skills  of  irm  staff.  As  we 
pointed  out  in  chapter  1,  oirm  officials  plan  to  issue  an  action  plan 
describing  specific  changes  to  implement  the  Department’s  objectives  in 
late  1992.  The  officials  indicated  that  the  forthcoming  action  plan  will 
include  steps  to  reassess  the  irm  planning  process  and  improve  the  skills 
of  irm  staff.  However,  because  the  action  plans  have  not  been  completed, 
the  oirm  officials  were  not  able  to  describe  the  specific  changes  that  will 
be  made. 
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doe  does  not  have  adequate  management  control  to  ensure  that  the 
acquisition  and  operation  of  information  systems  are  conducted  effectively 
and  in  accordance  with  laws  and  policies.  The  lack  of  management  control 
contributes — as  does  the  lack  of  strategic  planning — to  users’  not 
receiving  the  information  they  need,  and  to  wasted  resources. 

Management  control  is  achieved  through  a  system  of  policies,  procedures, 
and  practices — also  called  internal  controls — that  guide  and  regulate 
agency  activities.  Federal  law  requires  agencies  to  establish  and  maintain 
effective  controls,  doe  policy  generally  allows  each  site  to  establish  and 
maintain  its  own  controls  over  irm  activities.1  However,  these  controls  have 
not  prevented  the  development  of  overlapping  and  duplicate  systems, 
ensured  that  life-cycle  development  methodologies  are  used,2  or  ensured 
that  existing  systems  continue  to  meet  mission  needs. 

The  reason  sites  have  not  implemented  effective  control  is  that  doe  has 
not  clearly  delegated  irm  oversight  responsibilities  or  provided  sufficient 
authority  to  ensure  that  weaknesses  are  corrected.  Federal  internal 
control  standards  note  that  clear  lines  of  authority  and  responsibility  are 
essential  to  achieving  management  control. 


Management 
Is  Essential 


Control 


Management  control  is  essential  to  ensuring  that  agency  activities  comply 
with  applicable  laws,  program  objectives  are  met,  and  resources  are 
protected  against  fraud,  waste,  and  abuse.  The  Federal  Managers’ 
Financial  Integrity  Act,  31  U.S.C.  Sec.  3512  (b)  and  (c),  requires  the  heads 
of  executive  agencies  to  ensure  that  a  system  of  controls  exists  to  provide 
reasonable  assurance  that  resources  are  used  in  compliance  with  laws  and 
are  protected  from  fraud,  waste,  and  abuse.  Agencies  must  submit  annual 
reports  to  the  President  and  Congress  identifying  material  internal  control 
weaknesses  that  could  lead  to  significant  waste  or  hamper  an  agency’s 
ability  to  accomplish  its  missions.  Federal  standards  state  that  program 
managers  need  to  maintain  control  over  the  resources — including 
information  resources — entrusted  to  their  care.  In  addition,  because  the 
Paperwork  Reduction  Act  makes  the  bso  responsible  for  ensuring  that 
information  resources  are  effectively  managed,  the  dso  needs  to  ensure 
that  program  managers  maintain  this  control. 


'DOE  Orders  define  a  site  to  be  (1)  a  field  element,  including  field  offices,  power  marketing 
administrations,  and  energy  technology  centers;  (2)  an  M&O  contractor,  (3)  headquarters;  or  (4)  the 
Energy  Information  Administration. 

*Life<yo!e  methodologies  generally  include  (1)  analyzing  users'  requirements,  (2)  conducting 
alternative  and  cost/benefit  analyses,  (3)  building  the  system,  (4)  documenting  the  developed  software, 
(6)  testing  system  performance,  and  (6)  operating  and  maintaining  the  system. 


Page  97 


GAO/IMTEC-92-B3  Energy  Needs  Better  IRM 


Chapter  4 

Management  Control  Over  IBM  Activities 
Needs  Strengthening 


Controls  over  irm  activities  are  needed  to  provide  reasonable  assurance 
that  (1)  information  systems  satisfy  mission  needs  and  (2)  resources  are 
protected  against  fraud,  waste,  and  abuse.  For  instance,  the  Paperwork 
Reduction  Act  requires  agencies  to  ensure  that  they  do  not  develop 
information  systems  that  overlap  or  duplicate  existing  systems.  Federal 
Information  Processing  Standards  Publications  38  and  64  encourage 
agencies  to  use  life-cycle  system  development  methodologies  when 
acquiring  new  systems.  Using  life-cycle  methodologies  helps  ensure  that 
systems  meet  mission  needs  when  they  are  deployed.  Finally,  the 
Paperwork  Reduction  Act  requires  agencies  to  periodically  evaluate 
existing  information  systems  to  ensure  that  they  continue  to  meet  mission 
needs  in  a  cost-effective  maimer. 


doe  has  not,  however,  implemented  effective  control  over  its  irm  activities. 
Consequently,  it  is  not  preventing  waste  or  ensuring  that  new  and  existing 
systems  meet  mission  needs,  doe  gives  each  site  the  authority  to  establish 
and  maintain  controls.  In  many  cases,  however,  site  controls  are  not 
adequate  to  achieve  the  control  objectives.  In  addition,  doe  relies  on 
management  reviews  to  ensure  that  field  offices’  and  contractors’  irm 
activities  are  effective.  Although  these  reviews  have  repeatedly  identified 
problems,  they  often  do  not  lead  to  corrective  action. 

As  we  pointed  out  in  chapter  2,  doe  wastes  significant  resources 
developing  and  operating  overlapping  and  duplicate  information  systems. 
In  all  four  mission  areas  we  reviewed,  many  sites  had  developed 
information  systems  to  perform  the  same  or  similar  functions.  In  addition, 
newly  deployed  systems  supporting  the  environmental  restoration  and 
safely  and  health  missions  did  not  meet  managers’  information  needs. 
These  systems  were  developed  without  following  life-cycle  methodologies. 
Finally,  existing  systems  did  not  provide  managers  the  information  they 
need  to  accomplish  environmental  restoration,  safety  and  health 
maintenance,  nuclear  weapons  production,  and  security  missions. 


DOE’s  Management 
Control  Over  Key  IRM 
Activities  Is  Not 
Effective 


Controls  Are  Not  Effective  DOE  delegates  authority  for  establishing  controls  to  local  sites,  including 

program  offices,  field  offices,  and  contractors,  oirm  then  conducts 
management  reviews  to  evaluate  how  effectively  the  field  offices  and 
headquarters  program  offices  are  carrying  out  their  irm  responsibilities. 
Field  offices  in  turn  review  contractor  irm  activities.  These  oirm  reviews 
have  repeatedly  found  that  site  controls  are  not  effective.  We  evaluated  all 
oirm  management  reviews  conducted  between  May  1987  and  February 
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1992,  and  found  that  the  reviews  identified  extensive  weaknesses  in  how 
sites  acquire  and  operate  information  systems. 

First,  the  reviews  showed  that  in  many  cases  sites  do  not  have  sufficient 
controls  to  prevent  overlapping  and  duplicate  information  systems.  Of  the 
16  sites  reviewed,  in  8  cases  sites  were  not  effectively  preventing  overlap 
or  duplication  at  their  offices  or  at  contractor  facilities  under  their 
jurisdiction.  In  three  of  the  eight  cases,  sites  were  not  evaluating  whether 
planned  systems  overlapped  or  duplicated  existing  systems,  while  in  the 
other  five  cases,  sites  had  only  limited  success  eliminating  overlapping  and 
duplicate  systems  because  existing  systems  used  hardware  or  software 
that  was  incompatible  with  the  planned  system.  Because  doe  policy  allows 
each  site  to  establish  its  own  hardware  and  software  standards,  doe  does 
not  foster  development  of  compatible  or  integrated  information  systems. 
As  a  result,  the  existence  of  incompatible  systems  is  generally  accepted  by 
oirm  as  a  barrier  to  preventing  overlap  and  duplication. 

The  doe  management  reviews  also  found  that  many  sites  do  not  use 
life-cycle  methodologies  when  developing  systems.  Of  the  16  sites 
reviewed,  in  6  cases  sites  were  not  following  life-cycle  methodologies  at 
their  offices  or  at  contractor  facilities  under  their  jurisdiction.  In  one  of 
the  six  cases,  the  site  had  not  established  software  management  programs 
to  require  the  use  of  life-cycle  methodologies,  while  in  the  five  other  cases, 
sites  had  developed  programs  but  were  not  consistently  using  life-cycle 
methodologies. 

Finally,  the  management  reviews  found  that  many  sites  have  not 
implemented  effective  controls  to  ensure  that  systems  continue  to  meet 
mission  needs.  Of  the  16  sites,  in  7  cases,  sites  were  not  ensuring  that  their 
systems  continued  to  operate  effectively  at  their  offices  or  at  contractor 
facilities  under  their  jurisdiction.  In  three  of  the  seven  cases,  sites  did  not 
have  a  program  to  evaluate  the  continuing  effectiveness  of  their 
information  systems,  while  in  the  four  other  cases,  sites  had  a  program  to 
evaluate  systems  but  few  evaluations  were  actually  performed.  The 
management  reviews  noted  that  the  number  of  systems  evaluated  varied 
greatly  from  site  to  site,  depending  on  the  amount  of  resources  devoted  to 
the  task. 


Although  oirm  reviews  of  site  irm  policies  and  procedures  have  often 
detected  weak  controls,  corrective  actions  are  not  consistently  taken 
because  the  recommendations  are  often  not  implemented.  All  three  field 
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offices  we  visited  were  cited  in  management  reviews  as  not  having 
effective  controls  to  achieve  one  or  more  of  the  following  objectives:  (1) 
eliminating  overlapping  and  duplicate  systems,  (2)  using  life-cycle 
methodologies,  or  (3)  ensuring  that  systems  meet  mission  needs.  However, 
none  of  the  three  field  offices  had  corrected  these  problems. 

oirm  officials  confirmed  that  findings  and  recommendations  from  previous 
management  reviews  are  often  not  implemented.  For  instance, 
management  reviews  in  1987  and  1989  cited  the  Albuquerque  field  office 
for  (1)  not  being  able  to  eliminate  overlap  and  duplication,  and  (2)  not 
having  an  effective  program  to  evaluate  existing  systems.  Although  the 
1990  review  did  not  discuss  either  of  these  deficiencies,  we  found — and 
Albuquerque  irm  officials  agreed — that  both  problems  still  exist. 


The  reason  extensive  and  longstanding  weaknesses  exist  in  doe’s  control 
over  irm  activities  is  that  the  Department  has  not  clearly  delegated  IRM 
oversight  responsibility  or  provided  sufficient  authority  to  ensure  that 
control  weaknesses  are  corrected.  The  resulting  unclear  lines  of 
responsibility  and  authority  make  it  difficult  to  hold  managers  accountable 
for  correcting  deficiencies.  This  contrasts  sharply  with  the  Secretary’s 
efforts  to  strengthen  accountability  by  clarifying  responsibility  and 
authority  to  control  other  important  resources,  including  financial  and 
human  resources. 


doe  IRM  orders  do  not  clearly  define  program  managers’  or  their  irm 
support  staffs’  responsibility  or  authority  to  control  the  activities  of 
subordinate  offices  or  m&o  contractors.  The  result  is  fragmented  lines  of 
responsibility  and  authority,  with  each  individual  office  responsible  for 
ensuring  that  it  maintains  effective  control  over  irm  activities. 

To  illustrate  the  fragmented  lines  of  responsibility  and  authority,  doe’s 
Computer  Software  Management  Order  encourages  sites  to  examine 
opportunities  to  use  existing  software  before  developing  new  software, 
and  discourages  sites  from  continuing  to  use  existing  software  if  another 
site  has  software  that  performs  the  same  function.  The  order  makes  each 
site  manager  responsible  for  carrying  out  this  policy  at  that  site.  Field 
office  managers  are  also  responsible  for  ensuring  that  contracts  include  a 
provision  requiring  m&o  contractors  to  comply  with  the  order.  However, 
the  order  does  not  define  headquarters  program  managers'  authority  to 
ensure  that  field  office  managers  comply  or  field  office  managers’ 


Program  Managers 
Exercise  Little  Control 
Over  IRM  Activities 


Control 

Responsibilities  Are 
Unclear  and  Authority 
Is  Limited 
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authority  to  ensure  that  Mao  contractors  comply.  Similarly,  it  does  not 
clearly  define  program  managers’  responsibility  and  authority  to  ensure 
that  life-cycle  methodologies  are  used  and  that  existing  systems  continue 
to  meet  mission  needs. 

IRM  support  staff  at  four  program  offices  said  they  did  not  have  adequate 
authority  to  control  field  office  or  contractor  irm  activities,  irm  staff  at  all 
three  field  offices  we  visited  also  agreed  that  they  do  not  have  enough  real 
authority  to  control  contractor  activities.  For  example,  the  acting  director 
of  the  iru.  organization  at  the  Albuquerque  field  office  said  his  office  does 
not  have  the  authority  to  require  contractors  to  develop  integrated 
information  systems  for  nuclear  weapons  activities,  even  though  doe 
recognizes  that  significant  benefits  would  occur.  He  cited  one  case  in 
which  the  field  office  developed  a  system  to  allow  contractors  to  share 
information.  However,  one  contractor  refused  to  implement  the  system 
because  it  preferred  to  use  its  own  system.  This  official  said  that  although 
doe  has  the  contractual  authority  to  require  the  contractor  to  use  the 
system,  he — as  a  staff  official — did  not. 

We  also  discussed  this  issue  with  the  Associate  Director  for  Procurement, 
Assistance,  and  Property — the  organization  responsible  for  administering 
m&o  contracts.  He  said  that  although  doe  has  broad  authority  to  hold 
contractors  accountable  for  complying  with  contract  terms,  in  some  cases 
office  heads  may  not  have  clearly  delegated  responsibility  and  authority  to 
individual  managers.  In  addition,  he  noted  that  individual  managers  may 
have  difficulty  holding  contractors  accountable  because  contractor 
responsibilities  are  not  always  as  clearly  defined  as  they  could  be.  He 
noted  that  doe  orders  often  contain  broad  policy  goals  rather  than  specific 
requirements  and  do  not  clearly  define  doe’s  responsibility  and  authority, 
versus  the  Mao  contractor’s  responsibility  and  authority.  As  a  result,  when 
these  orders  are  incorporated  into  the  contract,  they  can  be  difficult  to 
interpret  and  enforce.  He  stated  that  doe  has  recognized  the  need  to 
provide  more  specific  direction  to  contractors  and  to  incorporate  this 
direction  in  contracts,  doe  has  initiated  action  to  revise  the  orders  to 
clarify  doe  and  contractor  responsibilities. 


DSO  Has  Limited  Oversight 
Authority 


The  dso’s  authority  to  oversee  management  controls  departmentwide  also 
has  not  been  clearly  defined,  doe  orders  make  the  dso  responsible  for 
evaluating  the  effectiveness  and  efficiency  of  site  irm  activities,  but  do  not 
describe  the  dso’s  authority  to  require  corrective  action.  Instead,  the  dso's 
only  clear  authority,  when  dealing  with  field  office  or  contractor  control 
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deficiencies,  is  to  require  the  field  office  to  submit  information  system 
acquisition  plans  for  oirm  review  and  approval.  Similarly,  oirm  officials 
stated  that  doe  orders  do  not  provide  them  with  clear  authority  to  ensure 
that  doe  offices  and  mao  contractors  correct  deficiencies.  Lacking  clear 
authority,  these  officials  said  the  best  they  can  do  is  to  encourage  sites  to 
improve  control  over  their  irm  activities. 

oirm  officials  explained  that  doe  orders  do  not  provide  the  dso  authority  to 
oversee  site  irm  activities  because,  historically,  doe  policy  has  been  to 
allow  field  offices  and  mao  contractors  to  manage  their  own  activities  with 
minimal  interference  from  headquarters.  In  addition,  they  said  that 
changes  to  increase  the  dso’s  authority  might  be  difficult  to  achieve 
because  it  would  challenge  doe’s  traditional  power  structure.  They  noted 
that  since  any  change  to  authority  must  be  coordinated  throughout  the 
Department,  other,  more  powerful  doe  organizations  could  be  expected  to 
object  to  changes  that  might  impose  more  oversight. 

Recognizing  that  unclear  lines  of  responsibility  and  authority  have  led  to 
limited  accountability  and  control  weaknesses  in  other  important  areas, 
the  Secretary  issued  the  May  1991  directive  clarifying  program  managers’ 
oversight  responsibilities  and  authority.  The  Secretary  noted  that 
strengthening  line  management  control  and  accountability  is  the  linchpin 
with  which  he  can  assure  effective  and  efficient  accomplishment  of  doe 
programs,  while  maximizing  the  use  of  resources. 

As  we  pointed  out  in  chapter  3,  the  directive  strengthened  accountability 
by  increasing  headquarters  program  managers’  control — subject  to 
appropriate  oversight — over  field  office  and  contractor  activities. 

Although  the  directive  stated  that  the  concept  applies  to  other 
administrative  management  activities,  including  financial  and  human 
resources  requirements,  it  did  not  mention  either  program  managers’ 
responsibility  to  control  information  resources  or  the  dso’s  responsibility 
to  provide  oversight.  As  a  result,  accountability  continues  to  be  diluted 
and  irm  activities  continue  to  be  controlled  in  the  traditional  decentralized 
manner,  allowing  each  site  to  establish  and  enforce  its  own  controls  with 
limited  oversight  by  headquarters  program  offices  or  the  dso  We  believe 
that  citing  the  need  to  control  financial  and  human  resources,  but  not 
mentioning  irm  resources,  reflects  a  lack  of  recognition  of  the  importance 
of  controlling  irm  activities. 


Action  to  Strengthen 
Accountability  Has  Not 
Been  Applied  to  IRM 
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At  the  conclusion  of  our  review,  we  discussed  these  management  control 
deficiencies  with  the  Director,  oirm,  and  other  senior  oirm  officials,  who 
noted  that  the  Secretary’s  management  reforms  emphasize  the  need  for 
stricter  control  and  accountability  for  field  office  and  contractor  activities. 
They  said  that  the  Secretary’s  initiative  to  strengthen  accountability  was 
intended  to  cover  all  resources  needed  to  accomplish  missions,  including 
information  resources.  They  agreed,  however,  that  the  directive  did  not 
mention  information  resources,  and  that  doe’s  irm  oversight  process  has 
not  changed  to  conform  to  the  new  reporting  relationships. 

The  oirm  officials  also  agreed  that  control  over  irm  activities  could  be 
improved  and  that  policies,  procedures,  and  practices  should  be 
reassessed.  They  stated  that  doe’s  practice  of  relying  heavily  on  field 
offices  and  contractors  to  establish  and  enforce  their  own  controls  was 
adopted  in  part  because  oirm  does  not  have  enough  resources,  particularly 
irm  staff,  to  oversee  the  large  number  of  sites.  This  practice  also  reflects 
doe's  prior  operating  philosophy  of  relying  heavily  on  site 
officials — primarily  contractor  officials — to  control  their  own  activities. 

Finally,  the  officials  said  that  the  Department's  April  1991  initiative  to 
improve  the  effectiveness  of  irm  activities  addresses  the  need  to  revise  irm 
policies  and  procedures.  They  indicated  that  the  forthcoming  action  plan 
to  improve  irm  activities  will  include  a  reassessment  of  policies, 
procedures,  and  practices  for  acquiring  and  operating  information 
systems.  However,  because  the  action  plan  has  not  been  completed,  the 
oirm  officials  were  not  able  to  describe  the  specific  changes  that  will  be 
made. 


DOE  Officials 
Recognize  the  Need 
for  Stricter  Controls 
and  Accountability 
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An  underlying  reason  why  irm  planning  and  management  control 
deficiencies  exist  is  that  top  management  has  not  focused  its  attention  on 
irm  activities.  To  be  effective,  an  irm  program  requires  strong  leadership  by 
the  head  of  the  agency  and  support  by  senior  program  managers  and  the 
dso.  Although  the  Secretary  has  aggressively  attacked  other  problems 
facing  the  Department,  he  has  not  identified  irm  planning  and  control 
deficiencies  as  material  internal  control  weaknesses  under  the  Federal 
Managers’  Financial  Integrity  Act. 


Leadership  Is 
Essential  to  an 
Effective  IRM 
Program 


In  a  1990  gao  symposium,  leaders  from  industry,  the  Congress,  and 
executive  agencies  examined  the  challenges  agencies  face  in  managing 
information  resources,  and  agreed  on  several  principles  that  make  up  a 
framework  to  guide  the  acquisition  and  management  of  information 
technology.1  The  participants  agreed  that  successful  automation  efforts 
begin  with  a  top  manager  who  has  a  clear  vision  of  how  the  organization 
can  benefit  from  information  technology,  and  a  commitment  to  making  the 
vision  a  reality. 

After  articulating  the  vision,  agency  leaders  should  then  ensure  that 
strategic  and  tactical  plans — including  information  system 
architectures — are  developed  to  guide  the  implementation  of  the  vision. 
Symposium  participants  concluded  that  without  clear  direction  and 
support  from  the  top,  irm  initiatives  tend  to  degenerate  into  loose 
collections  of  independent  systems.  These  systems  often  do  not  meet  the 
organization’s  information  needs  because  the  developers  focus  on  their 
individual  units’  needs  rather  than  the  organization’s  larger  missions  and 
goals. 

The  symposium  also  pointed  out  that  partnerships  between  senior 
program  managers  and  the  dso  are  needed  to  define  and  implement  the 
vision.  Senior  managers  need  to  help  define  the  vision  because  they  are  in 
the  best  position  to  understand  how  information  can  help  accomplish 
mission  objectives.  The  dso  should  also  help  define  the  vision,  prepare  the 
agency’s  technology  plans,  and  ensure  that  ongoing  and  proposed  system 
development  projects  fall  logically  within  the  plans.  To  ensure  that  the 
dso’s  responsibilities  are  fulfilled,  the  symposium  participants  agreed  that 
agencies  need  to  redefine  the  role  and  elevate  the  authority  of  the  dso. 
Participants  also  reached  a  consensus  that  agencies  should  establish 


'Meeting  the  Government's  Technology  Challenge:  Results  of  a  GAO  Symposium  (GAGflMTEC-90-23, 
February  1990). 
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executive-level  boards  consisting  of  top  program  office  and  irm  managers 
to  ensure  that  the  vision  is  realized. 

Finally,  the  symposium  pointed  out  that  assembling  and  retaining  a  team 
of  highly  qualified  officials  to  manage  information  systems  projects  is 
essential.  One  participant  stressed  that  the  quality  of  people  supporting 
the  leaders  in  die  organization  will  determine  whether  the  vision  can  be 
carried  out.  The  symposium  recommended  that  agencies  find  new  ways  to 
maintain  the  management  continuity  that  is  essential  to  providing 
consistent  direction  and  clear  accountability.  The  use  of  advisory 
committees  and  individual  consultants  to  provide  consistent  institutional 
memory  and  perspective  was  one  suggested  method. 


Because  efforts  to  accomplish  Department  missions  and  correct 
management  deficiencies  rely  heavily  on  the  availability  of  timely, 
relevant,  and  reliable  information,  correcting  irm  deficiencies  should  be 
seen  as  essential  to  the  Secretary’s  efforts  to  improve  the  Department’s 
effectiveness.  Although  the  Secretary  has  identified  a  number  of  material 
internal  control  weaknesses,  he  has  not  identified  irm  deficiencies  as  a 
departmentwide  problem,  nor  has  he  put  forth  a  vision  of  how  information 
technology  can  help  accomplish  departmental  missions. 

The  limited  attention  devoted  to  irm  deficiencies  contrasts  sharply  with 
the  Secretary’s  actions  to  correct  other  problems.  In  response  to  complex 
challenges,  such  as  massive  environmental  damage  and  unsafe  nuclear 
weapons  production  facilities,  and  management  problems,  such  as  weak 
controls  over  contractor  activities,  the  Secretary  has  initiated  major 
reforms  and  changes  to  strengthen  accountability  and  improve  doe 
operations.  These  reforms  include  creating  new  organizations  such  as 
Environmental  Restoration  and  Waste  Management,  new  reporting 
structures  to  increase  line  managers’  accountability  for  achieving 
environmental  and  safety  and  health  objectives,  new  mission  planning 
processes,  and  strengthened  contract  provisions  and  contractor  oversight 
practices. 

The  dso  told  us  he  believes  the  Secretary  has  not  focused  his  attention  on 
irm  issues  because  other,  more  visible  problems  have  captured  his 
attention.  The  Department’s  senior  mission  planning  official  agreed,  noting 
that  the  Secretary  has  had  to  deal  with  controversial  policy  issues,  such  as 
the  circumstances  under  which  nuclear  material  production  facilities  will 


IRM  Deficiencies  Not 
Identified  as  a 
Departmentwide 
Problem 
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be  restarted,  and  equally  controversial  management  reforms  that  have 
required  iruyor  cultural  changes  throughout  the  organization. 


Establishing 
Partnerships  Requires 
Clear  Responsibility 
and  Authority 


Secretarial  leadership  is  important  to  ensuring  that  senior  program 
managers  and  the  dso  work  together  to  help  define  and  implement  the 
vision.  Senior  oirm  officials  and  program  office  irm  staff  told  us  that  senior 
program  managers  have  little  involvement  in  irm  activities  because  most 
do  not  recognize  that  they  have  an  important  role  to  play  in  managing 
information  resources.  Although  executive-level  irm  steering  committees 
are  an  accepted  way  to  ensure  that  senior  program  managers  focus 
attention  on  irm  issues,  doe  has  not  established  such  a  committee. 


As  part  of  his  April  1991  initiative  to  improve  irm,  the  dso  did  establish  an 
irm  council  to  assist  in  developing  changes  to  the  agency's  irm  program. 
Although  this  council  could  play  an  important  role  in  improving  irm,  it  is 
made  up  of  mid-level  irm  professionals  from  the  program  offices  and  oirm, 
rather  than  top-level  managers,  as  recommended  at  the  symposium. 
Because  neither  the  dso  nor  senior  program  managers  are  members  of  the 
council,  it  is  questionable  whether  the  council  will  have  the  executive-level 
perspective  or  authority  needed  to  define  an  effective  irm  vision  and 
ensure  its  implementation. 


It  is  also  questionable  whether  effective  partnerships  can  be  established 
without  more  clearly  defining  the  dso’s  and  program  managers’ 
responsibilities  and  authority.  As  we  noted  in  chapters  3  and  4,  unclear 
responsibility  and  limited  authority  reduce  the  dso’s  and  program 
managers’  ability  to  correct  irm  planning  deficiencies  and  control 
information  resource  activities.  Federal  internal  control  standards  point 
out  that  agencies  should  organize  in  a  way  that  provides  clear  lines  of 
authority  and  responsibility.  Secretarial  leadership  is  important  to 
clarifying  the  responsibility  and  authority  of  the  dso  and  program 
management  officials. 


Managers’  Concerns 
About  the  Availability 
of  Qualified  Staff  Are 
Important 


As  we  pointed  out  in  chapter  3,  the  senior  doe  mission  planning  official 
cited  the  need  for  staff  to  have  improved  technical  and  management  skills 
to  implement  an  effective  irm  strategic  planning  process.  In  chapter  4,  we 
pointed  out  that  oirm  managers  cited  insufficient  irm  staff  as  contributing 
to  deficient  management  control.  Secretarial  support  will  be  important  to 
ensuring  that  adequate  staff  with  the  appropriate  technical  and 
management  skills  are  available  to  manage  information  resources. 
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Since  being  appointed  in  1989,  the  Secretary  has  instituted  m^jor  changes 
to  improve  doe’s  ability  to  accomplish  its  missions.  These  reforms  were 
designed  to  correct  longstanding  deficiencies  in  doe  management 
practices,  deficiencies  that  have  contributed  to  severe  problems,  including 
massive  contamination  and  unsafe  nuclear  facilities.  Although  these 
reforms  have  resulted  in  significant  organizational  and  cultural  changes 
within  doe,  deficiencies  in  doe’s  management  of  information  resources 
have  not  been  corrected.  Effective  management  of  information  resources 
is  especially  important,  not  only  because  doe  has  a  multibillion-dollar 
investment  in  information  technology,  but  also  because  information  plays 
a  critical  role  in  helping  doe  accomplish  its  vital  missions.  Because  this 
information  is  crucial,  effective  action  to  correct  irm  deficiencies  is 
important  to  improving  doe’s  ability  to  accomplish  its  missions  and  reduce 
waste  and  inefficiency. 

The  primary  impact  of  irm  deficiencies  is  that  managers  and  staff 
throughout  doe  are  not  receiving  the  information  they  need.  As  a  result, 
they  are  hindered  in  accomplishing  their  missions.  This,  in  turn,  may 
increase  the  risk  that  the  public  will  be  unnecessarily  exposed  to 
dangerous  contaminants;  the  safety  and  health  of  workers  will  not  be 
adequately  protected;  outdated  weapons  components  will  continue  to  be 
produced  and  discarded;  and  facilities,  secrets,  and  employees  will  not  be 
properly  protected  from  threats.  In  addition,  doe  is  wasting  resources 
developing  and  operating  information  systems  that  overlap  or  duplicate 
existing  systems. 

These  problems  exist  because  doe  (1)  has  not  implemented  a  strategic  irm 
planning  process  that  focuses  information  resource  investments  on 
achieving  strategic  mission  objectives,  and  (2)  has  not  exercised  adequate 
management  control  to  ensure  that  irm  activities  are  conducted  effectively 
and  in  accordance  with  law  and  policy.  Without  a  strategic  irm  plan,  doe 
cannot  identify  the  information  needed  to  meet  mission  needs 
departmentwide,  doe  also  cannot  develop  tactical  plans  and  information 
system  architectures,  which  are  needed  to  ensure  that  information  system 
investments  are  cost-effective  and  meet  departmentwide  information 
needs. 

Similarly,  management  controls  are  essential  to  ensuring  that  irm  activities 
support  departmental  objectives.  Without  effective  control  over  the 
acquisition  and  operation  of  information  systems,  doe  has  difficulty 
ensuring  that  new  and  existing  information  systems  meet  mission  needs. 
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Management  controls  also  help  prevent  the  development  of  overlapping 
and  duplicate  information  systems. 

The  ability  of  program  managers  and  irm  oversight  staff  to  improve  irm 
planning  and  strengthen  controls  is  limited,  however,  because  neither  has 
been  assigned  clear  responsibility  or  sufficient  authority  to  do  so.  In  the 
absence  of  clear  statements  of  responsibility  and  authority,  doe  managers 
have  not  assumed  the  responsibility  for  strengthening  irm  planning  and 
management  controls.  According  to  senior  irm  and  mission  planning 
officials,  the  limited  number  of  skilled  staff  also  hinders  efforts  to  improve 
irm  activities.  Although  the  Secretary  has  strengthened  accountability  for 
accomplishing  Department  missions  by  assigning  headquarters  program 
managers — subject  to  appropriate  oversight — the  responsibility  and 
authority  to  plan  and  control  field  office  and  contractor  financial  and 
human  resources,  these  reforms  have  not  been  applied  to  the  management 
of  information  resources. 

Secretarial  and  senior  management  leadership  will  also  be  needed  to 
foster  changes  in  doe’s  traditional  culture  of  relying  on  individual 
headquarters,  field  office,  and  m&o  contractors  to  plan  and  control  their 
own  information  resource  activities.  Resistance  may  be  encountered 
because  improved  IRM  practices  will  disrupt  traditional  reporting 
relationships,  provide  for  more  centralized  authority  and  accountability, 
and  require  involvement  from  managers  who  have  traditionally  not 
managed  information  as  a  resource.  Identifying  irm  deficiencies  as  a 
departmentwide  problem  and  articulating  a  clear  vision  of  how 
information  technology  can  help  accomplish  doe  missions  would  help 
foster  the  needed  change.  Secretarial  and  senior  management  leadership 
will  also  be  important  to  (1)  establish  effective  partnerships  among 
program  managers  and  the  dso  and  (2)  ensure  that  staff  possessing  the 
necessary  technical  and  management  skills  are  available  to  implement 
improved  irm  practices. 

Although  the  dso  has  begun  efforts  to  improve  irm  activities,  these  efforts 
remain  largely  undefined  and  are  unlikely  to  correct  problems  unless  the 
improvements  involve  the  Secretary  and  senior  program  managers.  The 
Department’s  April  1991  document  begins  to  identify  important  objectives 
to  improve  irm  activities.  However,  because  the  document  was  intended  to 
be  a  high-level  description  of  opportunities  to  improve  irm,  it  does  not 
present  a  clear  vision  of  how  information  can  be  used  to  help  doe  achieve 
its  missions,  or  identify  specific  changes  that  will  be  made.  Thus,  we 
believe  this  initiative  does  not  lessen  the  need  for  Secretarial  and  senior 
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management  attention  to  highlight  the  significance  of  irm  deficiencies; 
provide  a  vision  of  how  information  technology  can  help  doe  achieve  its 
missions;  and  support  necessary  planning,  control,  and  organizational 
changes. 

Consequently,  until  the  Secretary  and  senior  managers  recognize  the 
gravity  and  extent  of  information  deficiencies  and  correct  the  underlying 
causes,  efforts  to  more  effectively  accomplish  departmental  missions  and 
strengthen  control  over  departmental  operations  will  be  hindered. 


Recommendations 


The  effective  management  of  information  is  important  to  assist  managers 
in  accomplishing  their  missions.  Secretarial  attention  is  also  essential  tc 
ensure  that  doe’s  irm  improvement  efforts  are  successful.  Therefore,  we 
recommend  that  the  Secretary  take  the  following  actions: 

Work  with  senior  program  managers  and  the  dso  to  develop  a  clear  vision 
of  how  better  information  and  improved  irm  can  contribute  to 
accomplishing  critical  missions,  and  commit  the  Department  to  making 
the  vision  a  reality  by,  for  example,  establishing  an  executive-level 
committee — consisting  of  top  program  managers  and  the  dso — to  oversee 
irm  improvements. 

Clarify  program  managers’  and  the  dso’s  responsibilities  and  authority  to 
plan  and  control  information  resources  throughout  the  Department, 
ensure  that  these  managers  are  knowledgeable  about  their  roles  and 
responsibilities,  and  ensure  that  adequate  staff  with  appropriate 
management  and  technical  skills  are  available  to  implement  improved  irm 
practices. 

Hold  the  dso  and  program  office  managers  accountable  for  (1)  linking  the 
irm  planning  process  to  the  Department’s  strategic  mission  planning 
process  and  preparing  strategic  and  tactical  plans — including  information 
system  architectures — that  support  the  Department’s  strategic  mission 
objectives;  and  (2)  revising  irm  policies,  procedures,  and  processes  to 
strengthen  management  control  over  headquarters,  field  office,  and  mao 
contractor  irm  activities. 

Identify  irm  deficiencies  as  a  material  internal  control  weakness  under  the 
Federal  Managers’  Financial  Integrity  Act  (31  U.S.C.  3512)  and  require  the 
dso  and  program  managers  throughout  the  Department  to  identify  specific 
internal  control  weaknesses  that  hinder  their  ability  to  manage 
information  resources,  irm  activities  should  continue  to  be  reported  as  a 
material  internal  control  weakness  until  the  Secretary  has  reasonable 
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assurance  that  information  resources  are  being  applied  efficiently  and  in 
accordance  with  laws,  regulations,  and  policies. 
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In  commenting  on  a  draft  of  this  report,  doe  stated  that  it  agreed  with  our 
recommendations  and  identified  a  number  of  specific  actions  it  will  take 
to  implement  them.  Although  these  actions  appear  to  be  generally 
responsive  to  our  recommendations,  they  do  not  fully  address  them.  In 
particular,  it  is  not  clear  what  doe  will  do  to  ensure  that  (1)  sufficient  staff 
with  appropriate  technical  and  management  skills  are  available  to 
strengthen  the  irm  program  and  (2)  information  system  architectures  are 
prepared  to  identify  information  needs  and  determine  the  best  alternative 
to  providing  the  information. 

Although  doe  agreed  with  our  recommendations,  it  disagreed  with  much 
of  chapter  2,  which  describes  how  irm  deficiencies  (1)  impair  managers’ 
efforts  to  accomplish  their  missions  and  (2)  waste  resources.  After 
reviewing  doe’s  comments  and  the  evidence  we  used  to  reach  our 
conclusions,  we  continue  to  believe  that  this  report  fairly  and  accurately 
describes  the  Department’s  information  deficiencies  and  their  effects. 
doe’s  written  comments  are  provided  in  appendix  I.1 


DOE  Agreed  to 
Implement  Most 
Recommendations 


doe  commented  that  it  supports  our  recommendations  and  stated  that,  in 
addition  to  actions  already  underway,  it  will  initiate  further  actions,  where 
appropriate,  to  ensure  that  the  recommendations  are  fully  addressed. 
Specifically,  the  Department  stated  that  it  will 

modify  its  irm  strategic  vision  statement; 

issue  a  Secretarial  notice  to  address  the  importance  of  irm  in  program 

managers’  oversight  responsibilities  and  authority; 

create  an  executive-level  committee  to  oversee  doe’s  irm  activities; 

issue  a  departmental  order  identifying  irm  and  program  officials’ 

responsibilities  and  authority  to  plan,  manage,  oversee,  and  control  irm 

activities; 

modify  its  strategic  planning  initiative  by  describing  the  relationship 
between  irm  planning  and  the  Department’s  strategic  mission  planning; 
and 

restructure  the  Department’s  irm  planning  so  it  is  better  aligned  with 
program  planning. 

doe  has  not  yet  agreed  to  identify  irm  deficiencies  as  a  material  internal 
control  weakness.  In  this  regard,  the  Department  plans  to  issue  guidance 
to  ensure  that  all  headquarters  and  field  elements  consider  the  issues 


'In  addition,  DOE  suggested  minor  corrections  and  editorial  changes,  which  have  been  incorporated 
where  appropriate. 
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raised  in  our  report  and,  in  turn,  report  any  material  deficiencies  to  the 
Secretary,  doe  stated  that  the  Departmental  Internal  Control  and  Audit 
Review  Council  will  review  identified  weaknesses  and,  if  warranted, 
recommend  that  irm  be  included  as  a  material  weakness  in  the  Secretary’s 
1992  report  to  the  President  and  Congress. 

Except  as  discussed  below,  these  actions  appear  to  be  responsive  to  our 
recommendations  and,  if  effectively  implemented,  should  significantly 
improve  the  information  available  to  doe  managers  and  staff. 


Further  Action  Is 
Needed  to  Fully 
Address 

Recommendations 


In  its  comments,  doe  did  not  respond  to  elements  of  two  of  our 
recommendations.  First,  it  did  not  identify  what  action  it  will  take  to 
ensure  that  sufficient  staff  with  appropriate  technical  and  management 
skills  are  available  to  implement  improved  irm  practices.  Second,  although 
doe  agreed  to  restructure  its  irm  planning  process,  it  did  not  specifically 
agree  to  prepare  information  system  architectures. 


We  believe  these  are  important  recommendations  and  that  doe  should 
clarify  what  action  it  will  take  to  implement  them.  Ensuring  that  sufficient 
staff  with  appropriate  skills  are  available  is  important  because  limited 
numbers  of  staff  with  the  appropriate  skills  has  hampered  and  will 
continue  to  hamper  doe’s  efforts  to  improve  irm  practices.  Similarly, 
preparing  information  system  architectures  is  important  because  the 
process  provides  a  disciplined,  systematic  approach  for  determining  the 
most  cost-effective  and  efficient  means  of  satisfying  the  agency's 
information  needs.  We  expanded  the  discussion  of  system  architectures  in 
the  report  to  emphasize  its  importance.  We  also  provided  oirm  officials 
with  a  copy  of  a  recently  issued  gao  staff  study  that  describes  a 
methodology  for  developing  architectures.2 


DOE  Disagrees  That 
Information  Shortfalls 
Impair  Missions  and 
Waste  Resources 


doe  disagreed  with  much  of  chapter  2,  which  describes  how  information 
deficiencies  impair  managers’  efforts  to  accomplish  their  missions,  and 
waste  resources,  doe  also  characterized  as  inflammatory  and  untrue  our 
conclusion  that  information  shortfalls,  in  turn,  increase  the  risk  that 

(1)  the  public  will  be  unnecessarily  exposed  to  dangerous  contaminants, 

(2)  the  safety  and  health  of  workers  will  not  be  adequately  protected, 

(3)  outdated  weapons  components  will  continue  to  be  produced  and 
discarded,  and  (4)  facilities,  secrets,  and  employees  will  not  be  adequately 
protected  from  threats,  doe  also  commented  that  some  overlap  and 


^AO/IMTEC-M-Bl,  June  1992. 
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duplication  of  information  systems  should  be  expected  and  that  our  report 
does  not  quantify  the  extent  or  cost  of  overlap  and  duplication. 

We  continue  to  believe  that  our  report  fairly  and  accurately  portrays  the 
information  deficiencies  at  doe  and  their  impact  on  managers’  ability  to 
accomplish  their  missions.  Our  findings  are  based  on  numerous  reports 
and  studies  by  doe  program  offices,  oirm,  the  Inspector  General,  gao,  and 
others,  as  well  as  on  our  discussions  with  senior  program  managers  and 
irm  officials  in  the  four  mission  areas.  This  evidence,  discussed  throughout 
our  report,  consistently  supports  our  findings,  doe’s  comments  regarding 
each  mission  area  and  our  analysis  of  the  comments  are  presented  below. 


Environmental  Restoration  doe  commented  that  environmental  restoration  managers  have  the 
Mission  information  they  need  to  carry  out  their  responsibilities.  However,  studies 

by  doe  and  others,  as  well  as  our  discussions  with  senior  Environmental 
Restoration  managers  from  headquarters  and  field  offices,  show  that  this 
is  not  the  case  and  that  the  lack  of  timely,  reliable,  and  relevant 
environmental  restoration  information  is  a  pervasive  problem. 

For  example,  according  to  doe  studies,  field  office  and  contractor 
managers  cannot  accurately  define  the  type  and  extent  of  contamination 
because  data  collected  to  assess  the  scope  of  contamination  are 
inaccurate,  inconsistent,  or  inaccessible.  An  Environmental  Protection 
Agency  report  pointed  out  that  its  analysts  responsible  for  overseeing  doe 
environmental  restoration  practices  are  inundated  with  lengthy  reports 
from  doe  that  they  are  unable  to  effectively  analyze.  We  believe  that  these 
deficiencies,  in  turn,  increase  the  risk  that  the  public  will  be  unnecessarily 
exposed  to  dangerous  contaminants.  In  fact,  our  report  cites  one  case  in 
which  a  report  identifying  the  need  to  secure  a  hazardous  site  was 
misplaced  for  almost  a  year,  thereby  delaying  headquarters  awareness  of 
the  danger  and  allowing  the  site  to  remain  open  to  the  public. 


Safety  and  Health  Mission  DOE  commented  that  it  disagreed  with  the  implication  in  our  draft  report 

that  because  certain  information  is  not  computerized  or  available  in  a 
centralized  computer  system,  managers  cannot  adequately  discharge  their 
safety  and  health  responsibilities,  doe  contends  that  safety  and  health 
information  is  available  in  numerous  automated  and  manual  information 
systems. 
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We  believe  that  doe’s  response  does  not  accurately  describe  the  serious 
information  deficiencies  that  exist  at  headquarters,  field  office,  and 
contractor  facilities.  We  found,  primarily  on  the  basis  of  discussions  with 
doe  safety  and  health  managers  and  a  doe  study,  that  the  departmentwide 
safety  and  health  information  system3  does  not  provide  the  information 
managers  said  they  need  to  carry  out  their  responsibilities.  In  addition, 
other  doe  studies  point  out  that  many  of  the  local  manual  and  automated 
systems  cited  by  doe  in  its  comments  also  do  not  provide  field  office  and 
contractor  managers  with  needed  information.  For  example,  one  doe 
report  noted  that  83  percent  of  field  offices  do  not  have  information 
systems  capable  of  tracking  safety  and  health  activities.  We  believe  these 
are  significant  information  deficiencies  that  deserve  immediate  attention. 


Weapons  Production  DOE  disagreed  that  a  lack  of  information  or  lack  of  systems  to 

Mission  communicate  information  causes  outdated  weapons  components  to  be 

produced.  However,  as  we  discuss  in  chapter  2,  doe’s  own  studies  have 
consistently  identified  the  inability  to  exchange  information  electronically 
as  a  problem  that  reduces  the  efficiency  of  its  nuclear  weapons 
manufacturing  and  business  processes.  For  example,  a  1989  study  noted 
that  the  inability  of  doe  facilities  to  exchange  design  information  in  a 
timely  and  reliable  way  creates  inefficiency  and  waste.  Further,  a  senior 
doe  weapons  complex  quality  control  official  and  irm  officials  confirmed 
that  doe  has  scrapped  millions  of  dollars’  worth  of  parts  due  to  continuing 
difficulties  exchanging  design  information. 


Security  Mission  DOE  commented  that  its  security  program  adequately  protects  its 

employees,  facilities,  and  secrets  from  threats.  We  found,  however,  that 
longstanding  information  deficiencies  continue  to  hinder  managers’  efforts 
to  ensure  an  effective  security  program,  thus  increasing  the  Department's 
vulnerability  to  threats.  For  example,  our  report  points  out  that  problems 
tracking  security  clearances,  first  identified  in  1987,  still  exist.  Similarly, 
doe  agreed  with  the  findings  in  our  1991  report  on  information  systems 
supporting  the  security  mission.4  That  report  pointed  out  that  difficulty 
identifying  patterns  and  trends  in  security  weaknesses  and  incidents  has 
reduced  security  managers'  ability  to  ensure  the  effectiveness  of  the 
security  program.  This  report  notes  that  doe  has  been  taking  steps  to 
improve  security  information  in  response  to  problems  cited  in  earlier  gao 


*We  refer  to  the  system  as  a  departmentwide  system  because  DOE  identified  it  as  such  in  its  Five-Year 
Information  Technology  Resources  Long-Range  Plan. 

4GAO/IMTEC-92-10,  Oct.  22,  1991. 
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reports.  However,  since  these  actions  have  not  yet  been  fully  implemented 
or  evaluated,  the  vulnerability  to  threats  still  exists. 


DOE  Believes  Some  With  regard  to  our  conclusion  that  doe  has  wasted  resources  developing 

Overlap  and  Duplication  and  operating  overlapping  and  duplicate  information  systems,  doe 
Should  Be  Exoected  commented  that  because  it  is  a  large  and  diverse  agency  that  has 

undergone  significant  changes  in  recent  years,  some  overlap  and 
duplication  will  occur.  The  Department  noted  that  our  report  did  not 
quantify  the  extent  or  cost  of  overlap  and  duplication.  The  Department 
also  asserted  that  we  had  assumed  that  designing  one  system  to  meet  the 
needs  of  all  users  is  the  most  cost-effective  alternative,  doe  pointed  out 
that  a  single  system  may  not  be  the  best  solution  to  satisfying  complex  and 
changing  information  needs. 

As  we  discuss  in  chapter  2,  we  found  significant  examples  of  unnecessary 
overlap  or  duplication  in  all  four  mission  areas  reviewed.  In  one  case,  the 
doe  Inspector  General  reported  that  three  sites  had  over  80  systems  to 
track  environmental  compliance  information.  Two  of  these  sites  had  spent 
a  total  of  nearly  $8.8  million  to  develop  and  operate  overlapping  and 
duplicate  systems,  doe  also  spent  $24  million  to  develop  and  operate  a 
departmentwide  system  to  track  environmental  compliance  information. 
Our  report  identifies  similar  examples  in  the  other  three  mission  areas. 
Although  we  do  not  attempt  to  quantify  the  amount  and  cost  of  overlap 
and  duplication,  the  evidence  in  our  report  convincingly  demonstrates  that 
overlap  and  duplication  are  pervasive  problems  and  that  significant 
resources  are  being  wasted.  At  the  conclusion  of  our  review,  senior  oirm 
officials  agreed  that  the  conditions  described  in  our  report  are 
representative  of  conditions  throughout  the  Department,  and  that  doe 
spends  a  significant  amount  of  resources  on  overlapping  and  duplicate 
systems. 

On  the  issue  of  a  single  system,  doe  misinterpreted  our  report.  We  do  not 
believe  that  a  single  system  to  satisfy  all  needs  is  always  the  most 
cost-effective  solution.  On  the  contrary,  we  believe  a  full  range  of 
alternative  technical  solutions  should  be  analyzed  to  identify  the  most 
cost-effective  alternative.  We  also  believe  that  alternatives  should  be 
developed  on  the  basis  of  a  full  understanding  of  information  needs 
departmentwide.  However,  as  we  point  out  in  chapter  3,  doe  does  not  have 
an  effective  strategic  planning  process  to  analyze  departmentwide  needs. 
Instead,  the  current  doe  practice  allows  each  site  to  define  its  own 
information  needs  and  develop  its  own  systems  to  meet  those  needs.  Our 
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recommendation  that  doe  prepare  system  architectures  is  intended,  in 
part,  to  provide  an  effective  mechanism  to  identify  common  information 
needs  and  select  the  most  cost-effective  alternative  to  meeting  those 
needs. 
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Department  of  Energy 

Washington .  DC  20585 
August  5,  1992 


Mr.  Victor  S.  Rezendes 
Director,  Energy  and  Science  Issues 
Resources,  Comnunity,  and 
Economic  Development  Division 
U.S.  General  Accounting  Office 
Washington,  D.C.  20548 

Dear  Mr.  Rezendes: 

The  Department  of  Energy  (DOE)  appreciates  the  opportunity  to  review  and 
comment  on  the  General  Accounting  Office  (GAO)  draft  report  entitled 
"Department  of  Energy:  Better  Information  Resources  Management  Needed  to 
Help  Accomplish  Missions.” 

The  report  recommends  that  the  Secretary  of  Energy  (1)  present  a  clear 
vision  of  how  information  and  information  resources  should  contribute  to 
accomplishing  critical  missions,  (2)  clarify  program  managers'  and 
information  resources  management  (IRM)  oversight  staff  responsibilities  and 
give  them  sufficient  authority  to  plan  and  control  information  resources 
Departmentwide,  (3)  hold  these  managers  accountable  for  linking  IRM 
planning  with  OOE's  strategic  mission  planning  process  and  strengthening 
controls  over  IRM  activities,  and  (4)  report  IRM  deficiencies  as  a  material 
Internal  control  weakness  until  the  Secretary  has  reasonable  assurance  that 
information  resources  are  being  applied  efficiently  and  in  accordance  with 
laws,  regulations,  and  policies. 

The  Department  supports  the  recommendations  made  by  GAO  to  improve  the 
management  of  IRM  in  DOE.  A  number  of  actions  are  already  underway  to 
address  some  of  these  recommendations.  Where  appropriate,  additional 
action  will  be  initiated  to  ensure  that  these  recommendations  are  fully 
addressed.  Specifically,  the  Department  will: 

-  Modify  its  IRM  vision  statement  and  communicate  it  to  all 
Departmental  Elements. 

-  Issue  a  notice,  under  the  Secretary's  signature,  to  specifically 
address  the  Importance  of  IRM  in  program  managers'  oversight 
responsibilities  and  authorities. 

-  Create  an  executive  level  committee,  chaired  by  the  Director  of 
Administration  and  Human  Resource  Management,  to  oversee  IRM 
activities. 

-  Issue  a  DOE  order  which  delineates  the  responsibilities  and 
authorities  of  IRM  and  program  officials  for  the  planning, 
management,  oversight,  and  control  of  IRM  activities. 
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-  Modify  the  Strategic  Planning  Initiative  (Secretary  of  Energy  Notice 
No.  25A,  dated  October  2,  1991)  to  Include  a  reference  to  1RM 
planning  and  its  relationship  to  the  Department's  strategic  planning. 

-  Restructure  Departmental  IRM  planning  more  along  program  lines. 

The  Department  will  also  carefully  consider  GAO's  recommendation  to 
identify  and  report  IRM  deficiencies  as  a  material  internal  control 
weakness  under  the  Federal  Manager's  Financial  Integrity  Act  (FMFIA). 
Guidance  will  be  issued  to  ensure  all  Headquarters  and  Field  Elements 
consider  the  issues  raised  by  GAO  and  report  any  material  and  significant 
IRM  deficiencies  in  their  FY  1992  FMFIA  assurance  memorandums  to  the 
Secretary.  The  Departmental  Internal  Control  and  Audit  Review  Council  will 
review  any  IRM  deficiencies  reported  by  Headquarters  and  Field  Elements, 
and,  if  warranted,  recommend  the  Inclusion  of  an  IRM  material  weakness  in 
the  Secretary's  FMFIA  report  to  the  President  and  the  Congress. 

GAO  states  that  the  Department  has  wasted  resources  developing  and 
operating  systems  that  overlap  or  duplicate  other  existing  Departmental 
systems.  Although  some  examples  of  overlapping/duplicating  were  provided 
in  the  report,  GAO  pointed  out  that  they  were  unable  to  quantify  the  extent 
or  cost  of  such  overlap  and  duplication.  In  fact,  most  of  the  examples  of 
overlap/duplication  discussed  in  the  report  were  identified  by  the 
Department.  DOE  is  a  very  large  and  diverse  organization  and  has  been 
experiencing  a  number  of  organizational  and  cultural  changes  in  recent 
years.  As  a  result,  some  overlapping/duplicate  systems  will  occur. 
Additionally,  the  assumption  in  the  report  is  that  designing  one  system  to 
meet  all  needs  is  the  most  cost-effective  alternative.  However,  this  is 
applicable  only  when  the  requirements  are  very  similar,  the  additional 
local  requirements  are  easy  to  incorporate,  the  integrated  system  can  be 
developed  quickly,  and  the  requirements  are  stable.  On  the  other  hand, 
overlapping  systems  can  be  beneficial  by  providing  tighter  coupling  to 
local  requirements,  clearer  local  accountability  for  performance,  lower 
individual  system  risk,  and  shorter  development  time. 

As  previously  discussed,  this  report  offers  recoranendations  to  improve  the 
contribution  of  IRM  to  the  Department's  missions.  DOE  basically  accepts 
these  recommendations  and  will  aggressively  move  to  Implement  them. 

However,  DOE  strongly  disagrees  with  GAO's  transitional  statements  of 
effect.  GAO  believes  that  the  Department  has  been  hindered  in 
accomplishing  its  mission  due  to  the  lack  of  information.  GAO  claims  that 
the  public  will  be  unnecessarily  exposed  to  dangerous  contaminants;  the 
safety  and  health  of  workers  will  not  be  adequately  protected;  outdated 
weapons  assemblies  will  continue  to  be  produced  and  discarded;  and 
facilities,  secrets,  and  employees  will  not  be  properly  protected  from 
threats.  We  believe  these  statements  to  be  inflammatory  and  untrue. 

Relative  to  the  Environmental  Restoration  and  Waste  Management  (EM) 
program,  GAO  maintains  that  lack  of  information  "...  Increases  the  risks 
that  the  public  will  be  unnecessarily  exposed  to  dangerous  contaminants;’ 
and  GAO  has  Incorrectly  attempted  to  relate  this  lack  of  information  to 
inadequate  'nformation  systems.  DOE  asserts  that  information  systems  do 
not  determine  the  nature  and  extent  of  environmental  contamination.  This 
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Is  determined  through  Field  characterization  activities  in  accordance  with 
a  process  that  is  prescribed  by  the  Environmental  Protection  Agency  under 
provisions  of  such  environmental  laws  as  the  Resource  Conservation  and 
Recovery  Act  (RCRA)  and  the  Comprehensive  Environmental  Response, 
Compensation,  and  Liability  Act  (CERCLA),  as  amended.  00E  managers  have 
the  information  they  need  to  determine  the  nature  and  extent  of 
environmental  contamination  in  CERCLA  and  RCRA  Investigation  Reports. 

These  reports  are  specifically  required  in  enforceable  environmental 
compliance  agreements,  consent  decrees,  and  permits.  They  specifically 
define  the  types  of  contamination  and  locations.  DOE  managers  use  these 
reports  both  in  the  Field  and  at  Headquarters  to  determine  any  necessary 
environmental  compliance  actions.  This  information  is  also  available  to 
the  public  in  reading  rooms  located  at  each  DOE  facility.  Until  EH  was 
established,  about  3  years  ago,  no  capability  existed  within  DOE  to 
centrally  manage  its  environmental  program.  EH  was  established  to  assess 
and  correct  environmental  problems  caused  by  decades  of  nuclear  weapons 
production  and  low  priority  to  environmental  concerns.  EH  is  working 
closely  with  DOE  Field  Offices  and  contractors  to  assure  that  all  sites 
properly  characterize  contaminants. 

Relative  to  safety  and  health  management,  GAO  maintains  ".  .  .  the  safety 
and  health  of  workers  will  not  be  adequately  protected.  .  .*  and  cites  the 
inadequacies  of  a  Departmentwide  system  for  tracking  safety  and  health 
activities.  This  is  not  accurate  since  there  is  no  Departmentwide  system 
for  safety  and  health.  The  Safety  Performance  Heasurement  System  (SPHS)  is 
an  interactive  computer  system  that  only  provides  a  collection  of 
independent  environment,  safety,  and  health  information  modules  for 
reference  by  DOE  and  its  contractors.  SPHS  provides  accident/incident 
information,  aids  in  developing  trend  and  causal  factors  analysis,  and 
provides  technical  information  and  communications  throughout  the 
Department.  Its  purpose  is  not  to  serve  all  of  DOE's  safety  and  health 
information  needs.  This  report  implies  that,  because  DOE  does  not  have 
certain  information  computerized  or  that  this  information  is  not  on  a 
centralized  system,  the  Department  cannot  adequately  discharge  its  safety 
and  health  responsibilities.  This  is  not  true.  Hany  sites  keep  manual 
logs  or  track  safety  and  health  through  local  information  systems.  Each 
site  has  its  own  unique  requirements  in  tracking  safety  and  health 
concerns;  therefore,  each  program  office  must  establish  and  maintain  an 
occupational  safety  and  health  program  for  their  contractor  employees. 
Consequently,  the  Program  Secretarial  Officers  and  their  contractors  are 
responsible  for  the  management  of  information  to  support  their  safety  and 
health  tracking  and  targeting  needs.  The  Department  also  recognizes  a  need 
for  a  centralized,  comprehensive  occupational  health  surveillance  system 
which  would  standardize  health  and  workplace  exposure  data  collection, 
storage,  and  management  and  provide  a  reliable  vehicle  for  tracking 
workers'  health  and  identifying  potential  workplace  hazards.  This  system 
now  is  under  development  by  the  Office  of  Environment,  Safety  and  Health. 

Relative  to  nuclear  weapons  production,  GAO  maintains  "...  outdated 
weapons  assemblies  will  continue  to  be  produced  and  discarded."  and  cites 
lack  of  information  or  the  ability  to  communicate  that  information  through 
systems  as  the  problem.  The  term  "weapons  assemblies"  generally  refers  to 
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a  complete  weapon,  such  as  a  warhead,  bomb,  or  reentry  vehicle.  &A0  Is 
referring  to  weapon  subassenblles  or  weapons  components,  such  as  electronic 
conponent  assemblies  or  mechanical  assemblies.  Lack  of  Information  or  lack 
of  systems  comauni eating  that  information  Is  not  the  cause  of  such  outdated 
subassemblies  being  produced.  Changes  in  weapons  production  are 
principally  due  to  design  changes  being  made  because  problems  are 
discovered  from  various  testing  programs  or  the  particular  program  is 
terminated  or  reduced  by  the  Department  of  Oefense.  When  one  of  these 
situations  occur,  components  produced  prior  to  the  design  change  may  have 
to  be  discarded  or  the  pipeline  of  parts  in  excess  of  the  requirement  may 
have  to  be  scrapped  if  there  is  no  other  use  for  those  parts. 

Relative  to  security  mission  areas,  GAO  maintains  *  .  .  .  facilities, 
secrets,  and  employees  will  not  be  properly  protected  from  tnreats.*  and 
again  cites  information  systems  as  the  problem.  We  believe  that  sufficient 
protection  is  in  place.  Further,  information  systems  have  been  redesigned 
or  are  in  the  process  of  being  Implemented  in  response  to  previous  GAO 
reports  to  assure  proper  protection.  DOE  Improvements  were  further 
identified  in  February  1992  to  enhance  the  effectiveness  of  these  systems 
via  a  scheduled  information  systems  review  program.  Information  systems 
cannot  be  static  due  to  changing  or  evolving  requirements  and  must  be 
reviewed  to  insure  they  continue  to  meet  mission  needs.  The  Office  of 
Security  Affairs  will  utilize  the  recoaeendations  of  the  Internal  DOE 
review  to  improve  their  systems. 

Minor  corrections  and  editorial  changes  have  been  presented  to  GAO  under 
separate  cover.  DOE  hopes  that  the  comments  in  both  letters  will  be 
helpful  to  GAO  in  their  preparation  of  the  final  report. 

Sincerely, 

Elizabeth  E.  Smedley  ' 

Acting  Chief  Financial  Officer 
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